Azure AD V1 endpoint registered native app: Graph API consent given but user can't get through

0
votes

When registering a native application on the Azure AD 1.0 endpoint, and assigning Graph API permissions, it seems like consented permissions are 'cached' somewhere and can't be managed properly.

Example scenario:

  1. Application registered and permission scopes (incl. ones requiring admin consent) assigned.

  2. Administrator consents to the permission scopes

  3. Simple user can use the app with consented permissions.

  4. Permission scopes change (adding a new one for example)

  5. Same admin doesn't get the consent form anymore

  6. Simple user is stuck with "consent required, have an admin account?"

  7. Another global admin must use the app for the first time to trigger the consent page.

Note that #7 doesn't always work; even if the other admin provides consent, simple users can't get through sometimes.

This is a multi-tenant application, yet when start using it in another tenant, I can not see its consented permissions in the AAD portal under enterprise applications.

Shouldn't permissions that have been consented to be listed in other tenants so that the admin can at least see what has been consented to?

Also, when I register an app on the V1.0 endpoint in my own tenant, I have an option to 'grant permissions' centrally, from the Azure AD portal for my tenant.

This option isn't available if I'm looking at an application that was registered in another tenant.

Am I overlooking something? Any help much appreciated.

1
azure-active-directorymicrosoft-graph-api
Might my article help: joonasw.net/view/the-grant-requires-admin-permission? – juunas
6. is a bit odd, in my experience the consent form is only shown if you require it explicitly, i.e. via prompt=consent. Also did the admin consent with prompt=admin_consent? Otherwise they only consented for themselves + app permissions. – juunas

1 Answers

1
votes

When you change permissions, it does not automatically re-consent (for user or admin). You can find a detailed overview of this at Understanding user and admin consent.

You'll first need kick off the Admin Consent workflow. For a multi-tenant app this is done by adding prompt=admin_consent to your OAUTH URL and having an Admin authenticate.

Once that is done you can also force existing users to re-consent as well by adding prompt=consent to your Auth URL.