在 Active Directory 上授予许可失败并出现错误

Question

I'm logged in as a global administrator, and I have an existing application with multiple roles. I'm trying to add an API permission to one of the app roles and because the roles are not showing in the client credentials flow, I learnt that I'll need to grant admin consent to that particular permission. however, when I do so I receive the below error

API Permissions

App Roles

Error

Grant consent failed with error: Claim is invalid: {Id} does not exist on resource application xxxxxx [some random values]

Answer 1

I was able to reproduce the same error, in which case the cause seems to be due to the application you're granting consent on ("This App"), having an app role added from another app ("Other App"), and this app role on "Other App" was deleted. You should be able to correlate the app ID in the error message to "Other App"

Answer 2

I was getting the error because I had permissions that were deprecated by Microsoft, and when I tried to grant admin consent it would re-apply admin consent to all permissions again not just the newly added ones. I resolved the problem by removing the deprecated permissions in the API Permissions page, they no longer display as a name and description, they'll show as a GUID so if that happened to you make sure you remove them.