Grant admin consent - granted consent not taken into account - azure-active-directory

Question

I have a JavaScript application, using MSAL.js 1.3.0. I'm prompted with the login screen and I'm able to login. But no matter how I configure the application in the Azure Portal, I'm always receiving thethe following message after I've logged in:
So, I granted the application admin consent: (which wasn't necessary for delegated permissions couple of weeks ago. Additionally, the page below doesn't show 'Admin consent required' at all)
But still, the behaviour doesn't change. I'm not able to get past the "need admin approval" message.
My coding is here:
config: {
msalConfig: {
auth: {
clientId: "b273e5a6-8940-481b-9c87-1b51310ff88c"
},
cache: {
cacheLocation: 'localStorage',
storeAuthStateInCookie: true
}
},
graphBaseEndpoint: "https://graph.microsoft.com/v1.0/",
userInfoSuffix: "me/",
queryMessagesSuffix: "me/messages?$search=\"$1\"&$top=150",
scopeConfig: {
scopes: ['User.Read', 'Mail.Read']
}
},
onInit: function () {
this.oMsalClient = new Msal.UserAgentApplication(this.config.msalConfig);
//check if the user is already signed in
if (!this.oMsalClient.getAccount()) {
this.oMsalClient.loginPopup(this.config.scopeConfig).then(this.fetchUserInfo.bind(this));
} else {
this.fetchUserInfo();
}
}
Here's my application manifest:
{
"id": "HERE-WOULD-BE-AN-ID",
"acceptMappedClaims": null,
"accessTokenAcceptedVersion": 2,
"addIns": [],
"allowPublicClient": null,
"appId": "b273e5a6-8940-481b-9c87-1b51310ff88c",
"appRoles": [],
"oauth2AllowUrlPathMatching": false,
"createdDateTime": "2020-06-09T10:31:12Z",
"groupMembershipClaims": null,
"identifierUris": [],
"informationalUrls": {
"termsOfService": null,
"support": null,
"privacy": null,
"marketing": null
},
"keyCredentials": [],
"knownClientApplications": [],
"logoUrl": null,
"logoutUrl": null,
"name": "2020-06-09 - Fiori Sandbox Test2",
"oauth2AllowIdTokenImplicitFlow": true,
"oauth2AllowImplicitFlow": true,
"oauth2Permissions": [],
"oauth2RequirePostResponse": false,
"optionalClaims": null,
"orgRestrictions": [],
"parentalControlSettings": {
"countriesBlockedForMinors": [],
"legalAgeGroupRule": "Allow"
},
"passwordCredentials": [],
"preAuthorizedApplications": [],
"publisherDomain": "d063937domain.onmicrosoft.com",
"replyUrlsWithType": [
{
"url": "https://d063937trial-d063937trialb-devspace-msgraph-ui.cfapps.eu10.hana.ondemand.com/ui/index.html",
"type": "Web"
}
],
"requiredResourceAccess": [
{
"resourceAppId": "00000003-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "570282fd-fa5c-430d-a7fd-fc8dc98a9dca",
"type": "Scope"
},
{
"id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
"type": "Scope"
}
]
}
],
"samlMetadataUrl": null,
"signInUrl": null,
"signInAudience": "AzureADandPersonalMicrosoftAccount",
"tags": [],
"tokenEncryptionKeyId": null,
"verifiedPublisher": {
"displayName": null,
"verifiedPublisherId": null,
"addedDateTime": null
}
}
PS: I'm not a JavaScript developer, just took the recently working app from a colleague and wanted to use it. If anything is missing, please let me know.
Cheers,
Max

Answer 1

If you want end users can consent to apps accessing company data on their behalf, you need to log into Azure Portal by using an admin account to enable this feature.
Go to Azure Active Directory -> Enterprise applications -> User settings, select Yes for "Users can consent to apps accessing company data on their behalf".
If you want end users can request access to applications that require admin consent, you could configure the admin consent workflow.

Answer 2

I had a similar issue. It was because I did not have an MPN ID in my App Registration. (MPN => Microsoft Partner Network)
The result was that Users (even Admin) would be redirected automatically but concent just didnt work.