Grant tenant admin consent to an application by programming/coding

Question

Grant tenant admin consent to an application by programming/coding

Yan Fang 0 Microsoft Employee

Hello, I have many test tenants and my work needs to grant tenant admin consent to an application.

The current solution is manual, here are the current steps I take:
1.Open browser and access this link:
https://login.microsoftonline.com/{$TenantId}/oauth2/authorize?client_id={$AppId}&response_type=code&redirect_uri=https://login.microsoftonline.com/common/oauth2/nativeclient

2.A login window pops up, login with the tenant admin account.

3.A consent window pops up, click "Accept".

My question is how to automate the process using programming approach to skip all interactive actions?

Navya 18,595 Reputation points Microsoft External Staff Moderator

2025-04-28T18:09:52.8266667+00:00

Hi @Yan Fang

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Navya 18,595 Reputation points Microsoft External Staff Moderator

2025-04-29T18:08:28.6366667+00:00

Hi @Yan Fang

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and "Up-Vote"   for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

1 answer

Your answer

Navya 18,595 Reputation points Microsoft External Staff Moderator

2025-04-28T18:09:52.8266667+00:00

Hi @Yan Fang

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Navya 18,595 Reputation points Microsoft External Staff Moderator

2025-04-29T18:08:28.6366667+00:00

Hi @Yan Fang

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and "Up-Vote"   for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

Vasil Michev 118.1K MVP Moderator

To add consent programmatically, you can use the appRoleAssignment endpoint (for application permissions): https://learn.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignments?view=graph-rest-1.0&tabs=http

Or the oAuth2PermissionGrant endpoint for delegate permissions: https://learn.microsoft.com/en-us/graph/api/oauth2permissiongrant-post?view=graph-rest-beta&tabs=http

If you prefer to use the Graph SDK for PowerShell, I have a more detailed writeup here: https://www.michev.info/blog/post/6080/how-to-manage-entra-id-delegate-permissions-for-specific-users

Yan Fang 0 Reputation points Microsoft Employee

2025-04-25T03:39:06.3866667+00:00

Thanks Vasil! One more question, I need both application permissions and delegate permissions, which solution is preferred? appRoleAssignment or oAuth2PermissionGrant? (PowerShell is not applicable for my work)
Vasil Michev 118.1K Reputation points MVP Moderator

2025-04-25T05:07:18.22+00:00

That would depend on the type of application you have. Delegate permissions are used when the application runs in the context of a user. If it runs without a signed in user, then you use the application permissions model instead. Refer to the official documentation for more info: https://learn.microsoft.com/en-us/graph/permissions-overview?tabs=http#permission-types

Share via

Grant tenant admin consent to an application by programming/coding

1 answer

Your answer