Microsoft Extra ID：Need admin approval

Question

I want to do the integration for Azure AD（Microsoft Entra ID） for our software system.

The request is

https://login.microsoftonline.com/76d29de0-851e-40bd-baa6-ca655e7f3a52/oauth2/v2.0/authorize?response_type=code&client_id=7e051a44-4b84-49b0-b9ca-67ed6f922d25&scope=User.Read&state=--qEJTtppF-FQ4VenHgwgwgE6e3eGLpmULHmqZNj6tI%3D&redirect_uri=http://localhost:8330/login/oauth2/code/azure

but is blocked by this message page

i have added the API/Permission about User.Read in the app setting page:

For now i don't know what can i do for the next. pls share the experience if some one know this issue. Thanks a lot!

Answer 1

Hello @Chencheng Ji,

Based on the error screenshot which you have provided, I understand that it is asking for admin consent approval to access the application.

When you grant tenant-wide admin consent to an application, you give the application access to the permissions requested on behalf of the whole organization. Granting admin consent on behalf of an organization is a sensitive operation, potentially allowing the application's publisher access to significant portions of your organization's data, or the permission to do highly privileged operations.

By default, granting tenant-wide admin consent to an application allows all users to access the application unless otherwise restricted. To restrict which users can sign-in to an application, configure the app to require user assignment and then assign users or groups to the application.

Important

Granting tenant-wide admin consent may revoke permissions that have already been granted tenant-wide for that application. Permissions that users have already granted on their own behalf aren't affected.

Prerequisites

Granting tenant-wide admin consent requires you to sign in as a user that is authorized to consent on behalf of the organization.

To grant tenant-wide admin consent, you need:

• A Microsoft Entra user account with one of the following roles:
  • Privileged Role Administrator, for granting consent for apps requesting any permission, for any API.
  • Cloud Application Administrator or Application Administrator, for granting consent for apps requesting any permission for any API, except Microsoft Graph app roles (application permissions).
  • A custom directory role that includes the permission to grant permissions to applications, for the permissions required by the application.

Grant tenant-wide admin consent in Enterprise apps pane

You can grant tenant-wide admin consent through the Enterprise applications pane if the application is already provisioned in your tenant. For example, an app could be provisioned in your tenant if at least one user consents to the application. For more information, see How and why applications are added to Microsoft Entra ID.

To grant tenant-wide admin consent to an app listed in Enterprise applications pane:

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
2. Browse to Entra ID > Enterprise apps > All applications.
3. Enter the name of the existing application in the search box, and then select the application from the search results.
4. Select Permissions under Security.
5. Carefully review the permissions that the application requires. If you agree with the permissions the application requires, select Grant admin consent.

Grant admin consent in App registrations pane

You can grant tenant-wide admin consent from App registrations in the Microsoft Entra admin center for applications your organization develops and registers directly in your Microsoft Entra tenant.

To grant tenant-wide admin consent from App registrations:

1. On the Microsoft Entra admin center, browse to Entra ID > App registrations > All applications.
2. Enter the name of the existing application in the search box, and then select the application from the search results.
3. Select API permissions under Manage.
4. Carefully review the permissions that the application requires. If you agree, select Grant admin consent.

Please refer to the below document if you have any queries.

Grant tenant-wide admin consent to an application - Microsoft Entra ID | Microsoft Learn

I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".