Approval required screen

Question

Approval required screen

JESUS MARTIN GARCIA ENCINAS 1

Unable to get status when admin approve consent from azure portal. Hence every time when user login, we are getting “Approval required screen”. Even Admin approved consent and email received to user that “Admin consent granted” but again while login, user is getting “Approval required screen”.
Is it any way to link or modify setting that approved users should not get “Approval required screen” again ?

CarlZhao-MSFT 46,426 Reputation points

2022-06-07T02:38:43.14+00:00

Hi @JESUS MARTIN GARCIA ENCINAS In my experience, if the admin has agreed all permissions on behalf of the organization in the Azure portal, then the admin consent page should not pop up when the user logs in. Can you provide your user login URL?
JESUS MARTIN GARCIA ENCINAS 1 Reputation point

2022-06-07T06:02:46.847+00:00

Sure, I'm currently using it on localhost, using the following parameters:

authority: 'https://login.microsoftonline.com/organizations/'
redirectUri: 'http://localhost:3000',
scopes: ['user.read'],
rompt: "select_account"

Or do you need me to upload it to a server and send you the link?
CarlZhao-MSFT 46,426 Reputation points

2022-06-07T10:22:58.757+00:00

Hi @JESUS MARTIN GARCIA ENCINAS
This is of course better, you can upload it to the server and share the link with me so that I can log in with my account and test the URL. Or you can also refer to the URL provided in my answer, this is used to log in and get the authorization code, it doesn't pop up the admin consent page.
JESUS MARTIN GARCIA ENCINAS 1 Reputation point

2022-06-07T15:53:34.423+00:00

Hello, I tried to login with the parameters that you gave me and when I click the button to open the popup it closes and throws the following exception:

ClientAuthError: endpoints_resolution_error: Error: could not resolve endpoints. Please check network and try again. Detail: ClientConfigurationError: untrusted_authority: The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter.

I tried deleting /oauth2/v2.0/authorize? of the URL to see if the tentant ID works and indeed it opens the popup without problems but the admin authorization still appears

I tried fixing the URL for some TYPO
/oauth2/v2.0/authorize/
/oauth2/v2.0/authorize?/
/oauth2/v2.0/authorize

And this did not solve the problem
JESUS MARTIN GARCIA ENCINAS 1 Reputation point

2022-06-07T17:53:13.937+00:00

Do you think the problem may be because I registered the app with my personal account and the application must be registered in the organization? (in this case, my university)

Or it doesn't matter which account you register the app with? I can obtain the tentant ID but I cannot register the application from the organization because I have restricted access to do so

1 answer

Your answer

CarlZhao-MSFT 46,426 Reputation points

2022-06-07T02:38:43.14+00:00

Hi @JESUS MARTIN GARCIA ENCINAS In my experience, if the admin has agreed all permissions on behalf of the organization in the Azure portal, then the admin consent page should not pop up when the user logs in. Can you provide your user login URL?
JESUS MARTIN GARCIA ENCINAS 1 Reputation point

2022-06-07T06:02:46.847+00:00

Sure, I'm currently using it on localhost, using the following parameters:

authority: 'https://login.microsoftonline.com/organizations/'
redirectUri: 'http://localhost:3000',
scopes: ['user.read'],
rompt: "select_account"

Or do you need me to upload it to a server and send you the link?
CarlZhao-MSFT 46,426 Reputation points

2022-06-07T10:22:58.757+00:00

Hi @JESUS MARTIN GARCIA ENCINAS
This is of course better, you can upload it to the server and share the link with me so that I can log in with my account and test the URL. Or you can also refer to the URL provided in my answer, this is used to log in and get the authorization code, it doesn't pop up the admin consent page.
JESUS MARTIN GARCIA ENCINAS 1 Reputation point

2022-06-07T15:53:34.423+00:00

Hello, I tried to login with the parameters that you gave me and when I click the button to open the popup it closes and throws the following exception:

ClientAuthError: endpoints_resolution_error: Error: could not resolve endpoints. Please check network and try again. Detail: ClientConfigurationError: untrusted_authority: The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter.

I tried deleting /oauth2/v2.0/authorize? of the URL to see if the tentant ID works and indeed it opens the popup without problems but the admin authorization still appears

I tried fixing the URL for some TYPO
/oauth2/v2.0/authorize/
/oauth2/v2.0/authorize?/
/oauth2/v2.0/authorize

And this did not solve the problem
JESUS MARTIN GARCIA ENCINAS 1 Reputation point

2022-06-07T17:53:13.937+00:00

Do you think the problem may be because I registered the app with my personal account and the application must be registered in the organization? (in this case, my university)

Or it doesn't matter which account you register the app with? I can obtain the tentant ID but I cannot register the application from the organization because I have restricted access to do so

Answer 1

Hi @JESUS MARTIN GARCIA ENCINAS

You can try this login URL:

https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/authorize?  
client_id={client id}  
&response_type=code   
&redirect_uri={redirect url}  
&response_mode=query  
&scope=https://graph.microsoft.com/user.read  
&state=12345

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Approval required screen

1 answer

Your answer