i want to validate my understanding here.
I have an web application and register this app in Azure AD. In Enterprise applications, i assign a set of users to the app without granting consent for that users.
-> If that users login to the app, will that work? I think not, as no consent is granted. From my understanding, every user has to grant consent to the app (depending on what the app requires) or an admin has to grant consent for all users.
I heard something different, that it is enough to just add the users to the app. So please shed some light on that:)
BR
Thomas
In Enterprise applications, i assign a set of users to the app without granting consent for that users. -> If that users login to the app, will that work? I think not, as no consent is granted.
By default, even though you don't grant consent for the users, the users can still log in to the app.
Without any granting, the user can sign in and the app can read user profile, and this not requires admin.
Related
Our app implements Azure OAuth2 (v2) user-consent flow and uses Graph API scopes that do not require admin consent oauth2 user. Recently we've noticed that some users of our app run into this Auth screen: "The app requires admin's approval".
Is that because the tenant Org disabled user-consent for apps?
Where does it leave us with the user-consent based OAuth2 flow? Is it still possible to get a user access token after an admin's approval or the only way is to use the OAuth2 daemon flow oauth2 daemon? In a callback after such a dialog how can we know that the admin approval has been given?
One related question. In cases where user-consent is not disabled but it's an admin user that authorizes there is an option 'Consent on behalf of your Organization". How can we know in the callback from this dialog that the admin checked that box? And does it mean we need to use the OAuth2 daemon flow then too?
Thank you
It was our lack of understanding. After more testing we realized that we used prompt=consent and that is why the consent window always showed. Thank you.
Is that because the tenant Org disabled user-consent for apps?
Yes, this settings is under Enterprise applications->User settings.
Is it still possible to get a user access token after an admin's
approval
Yes, you can still get a user access token after an admin's approval.
In a callback after such a dialog how can we know that the admin
approval has been given?
Once your admin reviews the request you will be notified via email.
In cases where user-consent is not disabled but it's an admin user
that authorizes there is an option 'Consent on behalf of your
Organization". How can we know in the callback from this dialog that
the admin checked that box?
Once the admin checked the box, the users under that tenant will not see the consent dialog. Also, you can check the status of the application in Azure portal->App registrations->your app->API permissions.
There are two possible reasons users consent or adminconsent
For user consent two possible cases
1)In a tenant where user consent is disabled, for example, users can't consent to any permission. Azure AD-- > Enterprise apps ---> User settings ---> Users can consent to apps.
2) User assignment :Azure AD--- > Enterprise apps-- > (select app) --> Properties --> User assignment required
For Admin Consent two possible cases
1) App-only permissions always require a tenant administrator’s consent. If your application requests an app-only permission and a user tries to sign in to the application, an error message is displayed saying the user isn’t able to consent.
2) Certain delegated permissions also require a tenant administrator’s consent. For example, the ability to write back to Azure AD as the signed in user requires a tenant administrator’s consent.
Solution :
The prompt=admin_consent parameter(which request permissions from admin) can be used as a parameter in the OAuth2/OpenID Connect authorization request to grant the admin consent .
Enable the admin consent workflow , which gives end users a way to request access to applications that require admin consent.
Refer the permissions documentation for the Microsoft Graph API indicate which permissions require admin consent.
My AD tenant has user consent disabled, i.e., all permissions added to AD app registration need an admin consent.
For an application using static permissions/scopes (v1.0 OAuth/OpenId endpoint), is it possible to add new permissions such that until the admin consent is granted, users can continue using features which require only the existing consented scopes?
Microsoft docs say: "The app needs to know all of the resources it would ever access ahead of time. It was difficult to create apps that could access an arbitrary number of resources." Does it mean that for my scenario, all users need to wait for admin consent before they can access the app?
I receive the below error when a user tries logging in to the app using the Open ID Connect flow. For reference, my login URL is similar to https://login.microsoftonline.com/{tenant}/oauth2/authorize?response_type=id_token&client_id=b8ad6a99-cd23-40a6-a1b4-1184af990aa2&redirect_uri=https%3A%2F%2Flocalhost%2F&state=13ccfb84-cfd1-4cb0-bfe3-bb2c227e19f7&client-request-id=4d76947a-0000-48af-aeff-7bc2d5e40000&x-client-SKU=Js&x-client-Ver=1.0.17&nonce=ef1caa16-d3fe-4523-a9c9-000000000000
is it possible to add new permissions such that until the admin consent is granted, users can continue using features which require only the existing consented scopes?
Yes, you can.
When the admin consent the API permission of an AD App(App registration), the permissions essentially will be given to the service principal(Enterprise application) in your AAD tenant. Actually if you use the AD App in your tenant, the permissions are essentially from the service principal.
You could refer to the screenshot below, there are four permissions, the two permission has been granted.
Navigate to the Overview, click the option Manage application in local directory.
Then in the Permissions, you will find the two permissions which have been consent.
When you add the new scopes, the app will keep working, but it will only be able to access the old scopes until the admin consents to the new scopes.
Thanks!
Alex Simons
I want to use AAD for PowerBI Rest API and thus need to get Token for auth. Even the permission granted to App does not need Admin consent yet, I always receive a popup saying:
<App> needs permission to access resources in your
organization that only an admin can grant. Please ask an admin to
grant permission to this app before you can use it.
App API Permissions (see no where it requires Admin consent)
Code I am using for auth:
var userAuthnResult = authenticationContext.AcquireTokenAsync(
ProgramConstants.PowerBiServiceResourceUri,
ProgramConstants.ClientID,
new Uri(ProgramConstants.RedirectUri),
new PlatformParameters(PromptBehavior.Auto)).Result;
P.S I have tried auth. using creds which is not working for me due to multi-factor auth on my org.
var userAuthnResult = authenticationContext.AcquireTokenAsync(
ProgramConstants.PowerBiServiceResourceUri,
ProgramConstants.ClientID,
userCreds).Result;
If your organization has disabled or restricted users' authorization to consent to applications, you won't be able to grant consent yourself, even if the permissions your app is requesting don't require admin intervention.
You can check if user consent is enabled or disabled in your organization in the Azure portal > Azure AD > Enterprise apps > User settings. (Even if you're not an administrator, you should be able to see if the switch it on or off.)
When registering a native application on the Azure AD 1.0 endpoint, and assigning Graph API permissions, it seems like consented permissions are 'cached' somewhere and can't be managed properly.
Example scenario:
Application registered and permission scopes (incl. ones requiring admin consent) assigned.
Administrator consents to the permission scopes
Simple user can use the app with consented permissions.
Permission scopes change (adding a new one for example)
Same admin doesn't get the consent form anymore
Simple user is stuck with "consent required, have an admin account?"
Another global admin must use the app for the first time to trigger the consent page.
Note that #7 doesn't always work; even if the other admin provides consent, simple users can't get through sometimes.
This is a multi-tenant application, yet when start using it in another tenant, I can not see its consented permissions in the AAD portal under enterprise applications.
Shouldn't permissions that have been consented to be listed in other tenants so that the admin can at least see what has been consented to?
Also, when I register an app on the V1.0 endpoint in my own tenant, I have an option to 'grant permissions' centrally, from the Azure AD portal for my tenant.
This option isn't available if I'm looking at an application that was registered in another tenant.
Am I overlooking something? Any help much appreciated.
When you change permissions, it does not automatically re-consent (for user or admin). You can find a detailed overview of this at Understanding user and admin consent.
You'll first need kick off the Admin Consent workflow. For a multi-tenant app this is done by adding prompt=admin_consent to your OAUTH URL and having an Admin authenticate.
Once that is done you can also force existing users to re-consent as well by adding prompt=consent to your Auth URL.
As you can see from the image, it's not letting regular users login to the application. How do I bring down this access to members? This is an azure active directory application. I can login just fine with an admin user but my regular accounts gets blocked. Note, I created the application with the regular account. I don't suppose this has something to do with it?
I've granted the app all delegated permissions. No application permissions though. I'm thinking there's something in the manifest I need to alter but I'm not sure and I've never messed with this before. So any help is appreciated.
You likely need to perform admin consent for the application. There are two ways to do this in Azure AD:
In the Azure portal, you can go into the App Registrations blade, then click on the App, click on Permissions, and hit Grant Permissions.
Construct a request to Azure AD with the extra parameter &prompt=admin_consent.
For example:
https://login.microsoftonline.com/common/oauth2/authorize?client_id=<AppID>&resource=<Resource App ID URI>&response_type=code&redirect_uri=<Redirect URI>&prompt=admin_consent