MSAL-angular asking for additional premissions

Question

I'm new to MSAL and having trouble for something that seems rather simple.

Im currently making a dashboard app that can read a tenants information trough the Microsoft Graph. So far I've added new tenants by making an app registration trough Azure portal. Now I would like to automate this process by letting the user login and have the app create the registration for him.

I used this tutorial to get started with MSAL and everything works fine until the point I try to ask for more premissions

The way I understand it is that I would need to add premissions I need to the consentscope in MsalModule

 MsalModule.forRoot(
      {
        auth: {
          clientId: "c91b9c1f-662c-491c-870c-fff04dd9b065",
          redirectUri: "https://parigxprz.github.stackblitz.io"
        },
        cache: {
          cacheLocation: "localStorage",
          storeAuthStateInCookie: isIE // set to true for IE 11
        }
      },
      {
        popUp: !isIE,
        //adding extra premissions here
        consentScopes: ["user.read", "openid", "profile", "calendar.read","mail.read"],
        protectedResourceMap: [
          ['https://graph.microsoft.com/v1.0/me', ['user.read']],
        ],
        unprotectedResources: [],
        extraQueryParameters: {}
      }
    )

And that it would show up in here

Now unfortunately that doesnt seem to be the case for me as it only asks for the premission to read the basic profile and not the calendar or the mail. Ive also tried adding it to the loginpopup call like so

 this.authService.loginPopup({
        extraScopesToConsent: ["user.read", "openid", "profile", "calendar.read","mail.read"]
      });

But that doesnt really seem to change much.

Here's a stackblitz using the sample app from the azure sample github.

https://stackblitz.com/edit/github-o6tcvk?file=src%2Fapp%2Fapp.component.ts

Any help would be appreciated.

Answer 1

You need to configure this in the app registration in the Azure portal. Look at the apis section and select the appropriate permissions under the graph api. You may have to grant admin consent before your users can approve access.