1
votes

I am running into the following issue while allowing administrators to sign up a company.

1)I created a multi-tenant web application with Azure authentication and deployed to Azure.

2)Under the Windows Azure AD permission settings for this app, I checked the following permissions

 Application Permissions :  Read Directory Data
 Delegated Permissions : Sign in and read user profile

3)When I try to launch the application and sign in as a user I am presented with a screen that says

This application requires application permissions to another application. Consent for application permissions can only be performed by an administrator. Sign out and sign in as an administrator or contact one of your organization's administrators.

4)I logged in as the admin and I am now presented with the admin consent screen. After accepting, I was able to browse through the website. admin consent screen

5)When I logged back as the user, i am still presented with the same application permission error screen. As the admin has already consented, I would expect that the user can now sign in to the web app.

Please let me know if i need to set anything else.

1

1 Answers

3
votes

You need to add a link and/or button into your app that allows to consent for their tenant by including prompt=admin_consent in your OAuth2/Open ID Connect authorization request.

The "Admin consent" portion of this document goes into more detail: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-devhowto-multi-tenant-overview#admin-consent