如何使用Azure Active Directory授予应用程序对新用户帐户的访问权限？

Question

My web application uses Azure Active Directory for authentication. In my Azure Portal I have an application reference which hooks into the AAD, I also have all the relative keys in place within the web application itself. Everyone in my organisation can log in without any problems but any new user accounts that are added get a message:

You can't access this application Company App Registration Name needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.

This is a message that only new accounts get, I can see these new accounts within the AAD and they accounts are identical to other employees, it's as if it's out of sync. Does anyone know what I have done wrong or why new accounts are not automatically picked up?

Answer 1

I believe you can solve your issue by having an Administrator of your tenant consent to the application on-behalf-of the entire tenant, which should include all new and existing users.

To do this, the Administrator can simply go to a login endpoint with the query string prompt=admin_consent .

https://login.microsoftonline.com/<TenantID>/oauth2/authorize?client_id=<AppID>&response_type=code&redirect_uri=<RedirectURI>&prompt=admin_consent

You can use this template URL, and simply fill out the variables with your application and tenant information. Then, hand it to the administrator and have them consent to the app.

Let me know if this helps!