{"id":1845,"date":"2018-05-08T18:29:21","date_gmt":"2018-05-08T18:29:21","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/aaddevsup\/?p=1845"},"modified":"2018-05-08T18:29:21","modified_gmt":"2018-05-08T18:29:21","slug":"receiving-aadsts90094-the-grant-requires-admin-permission","status":"publish","type":"post","link":"https:\/\/blogs.aaddevsup.xyz\/2018\/05\/receiving-aadsts90094-the-grant-requires-admin-permission\/","title":{"rendered":"Receiving AADSTS90094: The grant requires admin permission."},"content":{"rendered":"

Introduction<\/h1>\n

This post is to help provide guidance when receiving the error : AADSTS90094: The grant requires admin permission.<\/em><\/p>\n

Typically this error is received when trying to get access to an AAD application registration. Please note that there are two different Microsoft application portals:<\/p>\n

https:\/\/portal.azure.com<\/a>\u00a0 (v1 application portal) and the https:\/\/myapps.microsoft.com<\/a> (v2 application portal).<\/p>\n

For details on the different application models, please visit the following link:
\nWhat’s different about the v2.0 endpoint?<\/a><\/p>\n

 <\/p>\n

These different application models require different processes in order to resolve the AADSTS90094 error.<\/p>\n

 <\/p>\n

V1 Application Resolution<\/h1>\n

If you are using an AAD Application Registration under the URL portal.azure.com,\u00a0 then all that needs to be done is to click the “Grant Permissions” button.<\/p>\n

NOTE: All application permissions require a tenant administrator to complete the consent process by clicking the “Grant Permissions” button.<\/h4>\n

 <\/p>\n

\"image\"<\/a><\/p>\n

 <\/p>\n

To apply the permission scopes to the application, use the “Grant Permissions” button.\u00a0 If any of the permission scopes check in the Enable Access<\/strong> blade have Yes <\/em><\/strong>in the “REQUIRES ADMIN” column then a user with administrative permissions on the tenant will need to complete the consent process by clicking the “Grant Permissions” button.<\/p>\n

 <\/p>\n

\"image\"<\/a><\/p>\n

 <\/p>\n

This is also described in the article : https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/application-dev-registration-config-grant-permissions-how-to<\/a><\/p>\n

 <\/p>\n

The link describes a second way to grant permissions.<\/p>\n

 <\/p>\n

V1 Application User Consent Disabled<\/h1>\n

 <\/p>\n

Sometimes the tenant doesn\u2019t allow users to consent for an application to access data on their behalf. This switch is shown in the picture below:<\/p>\n

\"image\"<\/a><\/p>\n

 <\/p>\n

If the admin disabled users to be able to consent to allow third-party multi-tenant applications access their user profile data in the directory, the admins must consent to these applications before users may use them.<\/p>\n

In this scenario, your app can require the users to provide the email of the admin of their tenant and send the admin-consent link to the admin.<\/p>\n

 <\/p>\n

Essentially in order to resolve the issue, you will have to get a global admin to generate the URL below. This is taken from the link : <\/span>https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/application-dev-registration-config-grant-permissions-how-to<\/a><\/p>\n

You can construct a request to login.microsoftonline.com<\/strong> with your app configs and append on &prompt=admin_consent<\/strong>. After signing in with admin credentials, the app has been granted consent for all users.<\/em><\/p>\n

So it would look like the below URL (replace with your app configs):<\/p>\n

https:\/\/login.microsoftonline.com\/<tenant-id>\/oauth2\/authorize?client_id=<client id>&response_type=code&redirect_uri=<Your-Redirect-URI-Https-Encoded>&nonce=1234&resource=<your-resource-Https-encoded>&prompt=admin_consent<\/code><\/pre>\n
V1 Enterprise Application\/ V1 Multi-tenant Applications Requiring Admin Consent<\/h1>\n
In order to grant admin consent to a multi-tenant application you have in your tenant you won’t be able to press the grant permissions button since the Application Registration is in the creator’s tenant where the original AAD Application Registration in. If you’re receiving this error when trying to grant admin consent to a multi tenanted AAD Application you will need to get a global admin to grant admin consent on behalf of all the users in the tenant, following the same steps in the section before.<\/p>\n
You will have to create this URL :<\/p>\n
https:\/\/login.microsoftonline.com\/<tenant-id>\/oauth2\/authorize?client_id=<client id>&response_type=code&redirect_uri=<Your-Redirect-URI-Https-Encoded>&nonce=1234&resource=<your-resource-Https-encoded>&prompt=admin_consent<\/code><\/p>\n
Replacing the fields respectively with your tenant ID, Client ID, Redirect URI, and resource. Please contact the main multi-tenant AAD Application owner for information on the resource URI, it can be found in the original AAD Application Registration’s properties.<\/p>\n
 <\/p>\n
V2 Application Resolution<\/h1>\n
If you are using the https:\/\/myapps.microsoft.com<\/a> portal, then you will need to utilize the adminconsent endpoint in order to properly grant admin consent for the v2 application model. This is\u00a0 described in the Microsoft Documentation at the following link:<\/p>\n
https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/develop\/active-directory-v2-scopes#using-the-admin-consent-endpoint<\/a><\/p>\n
 <\/p>\n
<\/h1>\n
Conclusion<\/h1>\n
We have now described some scenarios where AADSTS90094<\/i> error could occur. If one of these solutions does not resolve your issue please file a support ticket and one of our support engineers will reach out to you to help resolve your issue.\u00a0 Please have the following information in your support request:<\/p>\n
    \n
  1. Fiddler trace if you can obtain one.<\/li>\n
  2. Correlation ID or Request ID\u00a0 along with its associated timestamp.\u00a0 With most AADSTS* <\/i>type errors, the correlation ID and timestamp is provided in the error body text.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"
    Introduction This post is to help provide guidance when receiving the error : AADSTS90094: The grant requires admin permission. Typically this error is received when trying to get access to an AAD application registration. Please note that there are two different Microsoft application portals: https:\/\/portal.azure.com\u00a0 (v1 application portal) and the https:\/\/myapps.microsoft.com (v2 application portal). For details on the different application models, please visit the following link: What’s different about the…<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,4,5],"tags":[17,23,40,61,73,74,76,83,84,106],"class_list":["post-1845","post","type-post","status-publish","format-standard","hentry","category-app-registration","category-authentication-flows","category-azure-ad","tag-aad","tag-aadsts90094","tag-azure-active-directory","tag-enterprise-applications","tag-grant-admin-consent","tag-grant-admin-permissions","tag-grant-requires-admin-permission","tag-how","tag-how-to","tag-multi-tenant-application"],"_links":{"self":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/posts\/1845"}],"collection":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/comments?post=1845"}],"version-history":[{"count":0,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/posts\/1845\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/media?parent=1845"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/categories?post=1845"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/tags?post=1845"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}