Assistance with OBO flow config in an enterprise Application

Question

I'm configuring an OBO flow between my app service and azure data explored, need some assistance, it's failing because of admin consent. How do I access and whom to contact?

Answer 1

Hello Renu Nair,

Greetings! Thanks for raising this question in the Q&A forum.

An admin consent failure in an On-Behalf-Of (OBO) flow almost always means the middle-tier app (your App Service) is requesting a delegated permission against the downstream API (Azure Data Explorer) that has not yet been granted tenant-wide consent, and delegated permissions to Azure Data Explorer are not user-consentable, so an end user hitting your app cannot grant it themselves even if they click through a consent prompt. This needs to be resolved from the Entra app registration side by someone holding the right admin role in your tenant, not from application code.

1. Confirm the API permission is correctly configured on your middle-tier app registration Go to the app registration that represents your App Service (the one acquiring the user's token and exchanging it for a Data Explorer token) and confirm it has a delegated permission added for Azure Data Explorer.

Microsoft Entra admin center > App registrations > [Your App Service app] > API permissions > Add a permission > APIs my organization uses > search for your Azure Data Explorer cluster or the well-known Kusto service (https://kusto.kusto.windows.net) > Delegated permissions > user_impersonation

If this permission is missing entirely, that is the first thing to add before consent can even be attempted.

1. Check whether you personally have rights to grant admin consent In the same API permissions blade, look for a "Grant admin consent for [tenant]" button. If it is greyed out or missing, your account does not currently hold a role that can consent on behalf of the tenant.

Microsoft Entra admin center > App registrations > [Your App Service app] > API permissions > Grant admin consent for <tenant>

Only Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator can perform this action, so if the button is unavailable, you need one of those role holders to do it for you.

1. If you cannot grant it yourself, find out who in your tenant can Check who currently holds those roles so you know who to contact.

Microsoft Entra admin center > Identity > Roles and administration > Global Administrator (and Application Administrator, Cloud Application Administrator)

Since you are listed as a Microsoft Employee, your tenant likely has a dedicated Identity or IT Service Desk team that manages app registrations and admin consent requests. Route this through your internal IT support ticketing system rather than this public forum, since granting consent is a tenant administrative action that has to happen inside your own organization's Entra tenant, not something Microsoft Support or this Q&A community can do on your behalf.

1. Alternatively, share a direct admin consent link with your admin If you know your app's client ID and tenant ID, you can generate a direct admin consent URL and send it to whoever holds the right role, which lets them consent in a couple of clicks without having to locate the app registration manually.

https://login.microsoftonline.com/{tenant-id}/adminconsent?client_id={client-id}

1. After consent is granted, confirm the signed-in user also has data-plane access on the cluster Admin consent on the Entra app registration only allows the token exchange to succeed. The user whose identity is being passed through the OBO flow still needs an actual role assignment on the Azure Data Explorer cluster and database itself (for example Database Viewer or Database User), otherwise the OBO-acquired token will authenticate successfully but queries will still fail with an authorization error.

Azure portal > Azure Data Explorer cluster > Databases > [database] > Permissions > Add

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.