Admin consent for OAUTH applications

Question

What is the user experience if you enable tenant wide admin consent for previously on boarded OAUTH applications?

Can you enable admin consent app by app

Answer 1

Hi @Chopra • Thank you for reaching out.

Are you talking about enabling the admin consent workflow, as documented HERE?

If yes, the change will affect previously registered OAuth applications as well. That means, if the application require permissions that need admin approval, user will be provided with a form to request for approval and provide a justification, as shown below.

When admin consent workflow is NOT enabled, users don't get an option to request approval by providing a justification. In that case, admin has to grant consent by either navigating to the Azure Portal > App Registration > your-app > api permissions or by accessing the application and provide organization wide consent by selecting the checkbox highlighted below:

• Can you enable admin consent app by app?

No, this setting is tenant wide setting and cannot be enabled on per application basis.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Changing the user consent setting only applies to consent events which take place after you make the change. If a user has already granted consent to an application, that user will continue to be able to sign in to and use that application. Only users who have not already granted consent and used the app will be blocked from granting consent themselves.