Microsoft Graph authorization_pending error

Question

Hi everybody, I am trying to set up an integration that uses Graph API through device code flow. I am totally new to this so here is what I have done. I requested admin consent for the application after logging in on microsoft. Our admin approved the request so I got an email saying that Admin consent granted. When I go back to the integration I am getting authorization_pending error. After a while token expires and I have to start all over again (including requesting approval).

I checked the microsoft documentation and it says
authorization_pending The user hasn't finished authenticating, but hasn't canceled the flow. Repeat the request after at least interval seconds.

I don't understand do I need to keep requesting admin consent? what am I supposed to do?

Answer 1

Hi @Enes OZDEMIR (ADEO) ,

I think there is a time limit of 15 min for sign in before it expires, as mentioned in the Document

Answer 2

But I am already logged in. So does it mean I have to log out and sign in only when requesting approval?

Answer 3

In this case I THINK, the "authorization_pending error" means the app used to sign in has not been confirmed/verified. The verification when using device code is done when receving the pgid "CmsiInterrupt". You then have to target the url in the urlpost (https://login.microsoftonline.com/appverify) with a body:

$requestBody = @{
	"canary"       = <canary value>
	"ContinueAuth" = $true
	"ctx"          = <ctx value>
	"flowToken"    = <flowtoken value>
	"hpgrequestid" = <sessionId value>
}

after POSTing that, the app is verified.

In the GUI that's the moment when pressing YES confirming the app when manually going through the device code flow