Active Directory中的管理员同意

Question

I think I'm missing an understanding of a development process under Azure AD. I develop a web app, that is authenticated via AD in our corp network, and uses some of our services (like Sharepoint and PowerBI).

It seems like for some of the functionality of Sharepoint, I need administrator consent (In app permissions I had to set Admin: Required). When I try to go to my app (which is located on localhost), it displays this:

this application requires application permissions to another application. 
Consent for application permissions can only be performed by an administrator. 
Sign out and sign in as an administrator or
         contact one of your organization's administrators.

As I understood a Global Administrator need to sign in into an application once, so other users (like me) could log in. But this workflow sounds faulty, I cannot ask our admin to go to my pc and sign in (I have a web app on localhost, so I cannot send him the link). Futhermore, what to do if he is located geographically in another place and just cannot go to my pc? He is also not ready to give me global admin rights just because of this.

This just sounds weird, and I feel like I simply missing something obvious. How do people actually develop such things without asking IT to get to their PCs each time they change something in auth logic?

Answer 1

I agree the UX is not phenomenal on this one.

Just logging in as an admin is not enough. You have to be logging in with the prompt query parameter set to admin_consent . At least when using the OAuth endpoint.

So you need to hit a URL such as https://login.microsoftonline.com/common/oauth2/authorize?client_id=your-client-id&redirect_uri=your-encoded-reply-url&response_mode=form_post&response_type=code+id_token&prompt=admin_consent .

Replace your-client-id with your app's client id, and your-encoded-reply-url with a valid reply URL for your app. Also replace common with your tenant id/domain name if your app is not multi-tenant.

If you want to do it the easy way, use Vittorio's nifty form at his blog . Just enter the tenant id (or common), reply URL, and your app's client id, tick the admin consent checkbox and click Go.

And yes, you need to be an admin in Azure AD to do this, so ask your admin to do this.

EDIT: With the newest update to the Azure Portal came the ability to grant permissions from the portal directly.

If you go to Azure Active Directory in the new portal, find your app registration there and click Grant Permissions under the Required permissions blade.