AADSTS90093：由于缺少权限，主叫方无法同意

Question

I'm getting the following error when non-global admin users are trying to access graph explorer 2 within our tenant:

Additional technical information:

Correlation ID: 2346b0f5-bb5f-4138-8f9d-07fa96dcf02f Timestamp: 2015-05-29 17:18:48Z AADSTS90093: Calling principal cannot consent due to lack of permissions.

From within Azure we have "users may give applications permission to access their data" set to use. We also have "users may add integrated applications" to yes.

Answer 1

Just wanted to check which URL you are going to. We have 2 "graph explorers" - one is for exploring Azure AD Graph API, while the other (called API explorer) is for exploring the Office 365 unified API .

If you are going to https://graphexplorer2.cloudapp.net - this is (AAD) graph explorer, and should not require admin permissions. Please let us know if this is what you are using and if this is causing issues.

If on the other hand you are going to https://graphexplorer2.azurewebsites.net - this is the API explorer, and due to the number of APIs it requires access to, it currently requires admin consent. We'll look into a way to reduce the number of scopes that this requires access to, to get to a place where users can consent (but that's not the case currently).

Hope this helps,

Answer 2

I ran into this issue today and here what I did:

• Login to your AD application in classic portal ( https://manage.windowsazure.com/ )
• Under "Configure" section, there is "permissions to other applications", look at the "delegated permissions" for "Window Azure Active Directory".
• Make sure you pick the correct permissions for your app. Normally, "Sign in and read user profile" is enough for user to login.
• For more information you can take a look at this link https://graph.microsoft.io/en-us/docs/authorization/permission_scopes

Answer 3

I worked for Skype for business online use case (WEB API). I faced this issue for users not global admins. The users who added by global admin.

I managed to resolve the issue by passing extra parameter prompt=admin_consent .

var href = 'https://login.microsoftonline.com/common/oauth2/authorize?response_type=token&client_id=';
    href += client_id + '&resource=https://webdir.online.lync.com&redirect_uri=' + window.location.href+'&prompt=admin_consent';

For more details visit link https://blogs.msdn.microsoft.com/exchangedev/2014/03/25/using-oauth2-to-access-calendar-contact-and-mail-api-in-office-365-exchange-online/