Grant admin consent - granted consent not taken into account

Question

I have a JavaScript application, using MSAL.js 1.3.0. I'm prompted with the login screen and I'm able to login. But no matter how I configure the application in the Azure Portal, I'm always receiving thethe following message after I've logged in:

So, I granted the application admin consent: (which wasn't necessary for delegated permissions couple of weeks ago. Additionally, the page below doesn't show 'Admin consent required' at all)

But still, the behaviour doesn't change. I'm not able to get past the "need admin approval" message.

My coding is here:

    config: {
                msalConfig: {
                    auth: {
                        clientId: "b273e5a6-8940-481b-9c87-1b51310ff88c"
                    },
                    cache: {
                        cacheLocation: 'localStorage',
                        storeAuthStateInCookie: true
                    }
                },
                graphBaseEndpoint: "https://graph.microsoft.com/v1.0/",
                userInfoSuffix: "me/",
                queryMessagesSuffix: "me/messages?$search=\"$1\"&$top=150",
                scopeConfig: {
                    scopes: ['User.Read', 'Mail.Read']
                }
            },

            onInit: function () {
                this.oMsalClient = new Msal.UserAgentApplication(this.config.msalConfig);
                //check if the user is already signed in
                if (!this.oMsalClient.getAccount()) {
                    this.oMsalClient.loginPopup(this.config.scopeConfig).then(this.fetchUserInfo.bind(this));
                } else {
                    this.fetchUserInfo();
                }
            }

Here's my application manifest:

{
    "id": "HERE-WOULD-BE-AN-ID",
    "acceptMappedClaims": null,
    "accessTokenAcceptedVersion": 2,
    "addIns": [],
    "allowPublicClient": null,
    "appId": "b273e5a6-8940-481b-9c87-1b51310ff88c",
    "appRoles": [],
    "oauth2AllowUrlPathMatching": false,
    "createdDateTime": "2020-06-09T10:31:12Z",
    "groupMembershipClaims": null,
    "identifierUris": [],
    "informationalUrls": {
        "termsOfService": null,
        "support": null,
        "privacy": null,
        "marketing": null
    },
    "keyCredentials": [],
    "knownClientApplications": [],
    "logoUrl": null,
    "logoutUrl": null,
    "name": "2020-06-09 - Fiori Sandbox Test2",
    "oauth2AllowIdTokenImplicitFlow": true,
    "oauth2AllowImplicitFlow": true,
    "oauth2Permissions": [],
    "oauth2RequirePostResponse": false,
    "optionalClaims": null,
    "orgRestrictions": [],
    "parentalControlSettings": {
        "countriesBlockedForMinors": [],
        "legalAgeGroupRule": "Allow"
    },
    "passwordCredentials": [],
    "preAuthorizedApplications": [],
    "publisherDomain": "d063937domain.onmicrosoft.com",
    "replyUrlsWithType": [
        {
            "url": "https://d063937trial-d063937trialb-devspace-msgraph-ui.cfapps.eu10.hana.ondemand.com/ui/index.html",
            "type": "Web"
        }
    ],
    "requiredResourceAccess": [
        {
            "resourceAppId": "00000003-0000-0000-c000-000000000000",
            "resourceAccess": [
                {
                    "id": "570282fd-fa5c-430d-a7fd-fc8dc98a9dca",
                    "type": "Scope"
                },
                {
                    "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
                    "type": "Scope"
                }
            ]
        }
    ],
    "samlMetadataUrl": null,
    "signInUrl": null,
    "signInAudience": "AzureADandPersonalMicrosoftAccount",
    "tags": [],
    "tokenEncryptionKeyId": null,
    "verifiedPublisher": {
        "displayName": null,
        "verifiedPublisherId": null,
        "addedDateTime": null
    }
}

PS: I'm not a JavaScript developer, just took the recently working app from a colleague and wanted to use it. If anything is missing, please let me know.

Cheers, Max

Have you checked by Setting the Users can consent to apps accessing company data on their behalf to Yes, after some delay, the normal user will be able to consent the app by himself. — Sruthi J
hey both, somehow my privileges in my companies tenant have changed recently. Tried doing exactly the same coding with an app registration in an Azure Trial tenant and everything worked fine. Your setting recommendation, @AllenWu, was already in place. That hasn't been the problem. — maxstreifeneder

Allen Wu Allen Wu · Accepted Answer · 2020-06-10T01:28:44

If you want end users can consent to apps accessing company data on their behalf, you need to log into Azure Portal by using an admin account to enable this feature.

Go to Azure Active Directory -> Enterprise applications -> User settings, select Yes for "Users can consent to apps accessing company data on their behalf".

If you want end users can request access to applications that require admin consent, you could configure the admin consent workflow.

Grant admin consent - granted consent not taken into account

1 Answers