以全局管理员身份登录时的AADSTS90093

Question

I'm trying to do the initial consent for an application registered in Azure AD that requires access to read directory data. I've activated my Global Admin role in Privileged Identity Management and hit the following URL in a new browser window.

https://login.microsoftonline.com/mytenant.onmicrosoft.com/oauth2/authorize?client_id=xxx&response_type=code&prompt=admin_consent&redirectUri=xxx

I'm getting the AAD error page saying I need to be an admin:

Additional technical information:
Correlation ID: 41ab9f3d-7430-4c46-aff4-a28e7f5398c2
Timestamp: 2016-05-12 15:03:27Z
AADSTS90093: This operation can only be performed by an administrator. Sign out and sign in as an administrator or contact one of your organization's administrators.

Why doesn't it recognize me as an admin?

Answer 1

There was a delay between the role assignment and when the application consent experience recognized the change. While a user may appear in their new role both in the Azure AD PIM experience as well as in the Azure management portal, the consent page required either 10-15 minutes, for the user to sign in again, to recognize the new role assignments.