How can I get admin approval for some Teams permission when developing Teams App

Question

Issue: "Admin approval required" when requesting Chat.ReadBasic in Teams tab app

App: <PII removed> ("LuckyDrawV2") Tenant: <PII removed>

Our Teams meeting side panel app needs Chat.ReadBasic (delegated) to call GET /chats/{chatId}/members. This permission is documented as user-consentable (no admin required), but we get "Admin approval required" at the consent prompt.

We suspect a tenant-wide policy is blocking user consent. We cannot run admin-consent ourselves (not a tenant admin), and tenant policy also blocks creating new app registrations or client secrets.

Ask: Please grant admin consent for Chat.ReadBasic on this app, or confirm whether a tenant policy is blocking user consent.

Answer 1

Hi @Pei Wang 

Thank you for posting your question in the Microsoft Q&A forum. 

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data. 

Although Chat.ReadBasic (delegated) is documented as a user‑consentable permission, the tenant has disabled or restricted user consent. As a result, the consent prompt correctly requires admin approval.

To proceed, a tenant administrator must grant admin consent to the permission for this app or update the tenant’s app/user consent policies to allow user consent.

If you're encountering issues with consent or permissions, please contact your organization's administrator. Microsoft Engineering cannot approve these scopes on your behalf. 

Hope this helps clarify the process! Let me know if you need further assistance. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 2

The “Need admin approval” screen appears because the app is requesting a permission that, in this tenant, is configured to require admin consent. Even if Chat.ReadBasic is user-consentable by default, tenant-wide consent settings can override this and force admin approval.

Because app developers in this tenant can’t grant tenant-wide consent or create new app registrations/secrets, the only way forward is through the tenant admins and the Entra/Teams consent controls.

Actions to take:

1. Ask a Global Administrator (or an admin with appropriate app consent rights) to grant consent
   • In Microsoft Entra admin center:
     1. Go to Identity > Applications > Enterprise applications.
     2. Locate the enterprise app corresponding to the Teams app (LuckyDrawV2).
     3. Open Permissions.
     4. Select Grant admin consent for <Organization> to approve the requested Microsoft Graph permissions (including Chat.ReadBasic).
   • This is the standard way to resolve AADSTS90094 / “Need admin approval” when non-admin users see that prompt.
2. Alternatively, use the Teams admin center consent flow (for custom/3rd‑party Teams apps)
   • A Global Administrator must:
     1. Open Teams admin center.
     2. Go to Teams apps > Manage apps.
     3. Find the app (LuckyDrawV2).
     4. In the Permissions column, select View details, or open the app and go to the Permissions tab.
     5. Review the listed Microsoft Graph permissions.
     6. Select Review permissions and consent, then Accept to grant org‑wide admin consent.
   • After this, users won’t be prompted for those permissions and the app can call GET /chats/{chatId}/members for allowed users.
3. If admins want users to be able to request approval themselves
   • Admins can enable the admin consent workflow in Microsoft Entra ID so that when users hit the “Approval required” screen, they can submit a request that goes to designated reviewers. Steps (for admins):
     1. Configure the admin consent workflow in Entra as described in the documentation.
     2. Once enabled, when users see “Approval required,” they can send a justification; reviewers receive a notification and can approve/deny.
4. Confirm whether tenant policy is blocking user consent
   • Only tenant admins can see and change these settings. They should review:
     • User consent settings and whether permissions like Chat.ReadBasic are restricted to admin consent only.
     • Whether group/owner consent or other consent restrictions are in place.
   • If user consent is disabled or restricted for this permission, the behavior being observed (forced admin approval) is expected.

Without tenant admin involvement, the app owner cannot bypass these policies. The resolution is for a Global Administrator to either:

• Grant tenant-wide admin consent to the app’s requested Graph permissions, or
• Adjust consent policies/admin consent workflow so that user consent or request/approval is possible.

---

References:

• Grant and manage consent to Teams app permissions
• Understand the permissions and information accessed by Teams apps
• Microsoft Entra ID permissions
• Admin consent on the Microsoft identity platform
• Overview of user and admin consent
• Corporate account apps registration error: AADSTS90094 - Microsoft Q&A