You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Unexpected error when performing consent to an application
18
18
19
-
This article discusses errors that can occur during the process of consenting to an application. If you are troubleshooting unexpected consent prompts that do not contain any error messages, see [Authentication Scenarios for Azure AD](../develop/authentication-vs-authorization.md).
19
+
This article discusses errors that can occur during the process of consenting to an application. If you're troubleshooting unexpected consent prompts that don't contain any error messages, see [Authentication Scenarios for Azure AD](../develop/authentication-vs-authorization.md).
20
20
21
-
Many applications that integrate with Azure Active Directory require permissions to access other resources in order to function. When these resources are also integrated with Azure Active Directory, permissions to access them is often requested using the common consent framework. A consent prompt is displayed, which generally occurs the first time an application is used but can also occur on a subsequent use of the application.
21
+
Many applications that integrate with Azure Active Directory require permissions to access other resources in order to function. When these resources are also integrated with Azure Active Directory, the permission to access them is often requested using the common consent framework. A consent prompt is displayed, which generally occurs the first time an application is used but can also occur on a subsequent use of the application.
22
22
23
-
Certain conditions must be true for a user to consent to the permissions an application requires. If these conditions are not met, the following errors can occur.
23
+
Certain conditions must be true for a user to consent to the permissions an application requires. If these conditions aren't met, the following errors can occur.
24
24
25
25
## Requesting not authorized permissions error
26
26
27
-
***AADSTS90093:**<clientAppDisplayName> is requesting one or more permissions that you are not authorized to grant. Contact an administrator, who can consent to this application on your behalf.
28
-
***AADSTS90094:**<clientAppDisplayName> needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.
27
+
***AADSTS90093:**<clientAppDisplayName> is requesting one or more permissions that you aren't authorized to grant. Contact an administrator, who can consent to this application on your behalf.
28
+
***AADSTS90094:**<clientAppDisplayName> needs permission to access resources in your organization that only an admin can grant. Ask an admin to grant permission to this app before you can use it.
29
29
30
-
This error occurs when a user who is not a Global Administrator attempts to use an application that is requesting permissions that only an administrator can grant. This error can be resolved by an administrator granting access to the application on behalf of their organization.
30
+
This error occurs when a user who isn't a Global Administrator attempts to use an application that is requesting permissions that only an administrator can grant. This error can be resolved by an administrator granting access to the application on behalf of their organization.
31
31
32
32
This error can also occur when a user is prevented from consenting to an application due to Microsoft detecting that the permissions request is risky. In this case, an audit event will also be logged with a Category of "ApplicationManagement", Activity Type of "Consent to application" and Status Reason of "Risky application detected".
33
33
34
34
Another scenario in which this error might occur is when the user assignment is required for the application, but no administrator consent was provided. In this case, the administrator must first provide tenant-wide admin consent for the application.
35
35
36
36
## Policy prevents granting permissions error
37
37
38
-
***AADSTS90093:** An administrator of <tenantDisplayName> has set a policy that prevents you from granting <name of app> the permissions it is requesting. Contact an administrator of <tenantDisplayName>, who can grant permissions to this app on your behalf.
38
+
***AADSTS90093:** An administrator of <tenantDisplayName> has set a policy that prevents you from granting <name of app> the permissions it's requesting. Contact an administrator of <tenantDisplayName>, who can grant permissions to this app on your behalf.
39
39
40
40
This error can occur when a Global Administrator turns off the ability for users to consent to applications, then a non-administrator user attempts to use an application that requires consent. This error can be resolved by an administrator granting access to the application on behalf of their organization.
41
41
@@ -49,19 +49,19 @@ This error indicates that an intermittent service side issue has occurred. It ca
49
49
50
50
## Resource not available in tenant error
51
51
52
-
***AADSTS65005:**<clientAppDisplayName> is requesting access to a resource <resourceAppDisplayName> that is not available in your organization <tenantDisplayName>.
52
+
***AADSTS65005:**<clientAppDisplayName> is requesting access to a resource <resourceAppDisplayName> that isn't available in your organization <tenantDisplayName>.
53
53
54
-
Ensure that these resources that provide the permissions requested are available in your tenant or contact an administrator of <tenantDisplayName>. Otherwise, there is a misconfiguration in how the application requests resources, and you should contact the application developer.
54
+
Ensure that these resources that provide the permissions requested are available in your tenant or contact an administrator of <tenantDisplayName>. Otherwise, there's a misconfiguration in how the application requests resources, and you should contact the application developer.
55
55
56
56
## Permissions mismatch error
57
57
58
-
***AADSTS65005:** The app requested consent to access resource <resourceAppDisplayName>. This request failed because it does not match how the app was pre-configured during app registration. Contact the app vendor.**
58
+
***AADSTS65005:** The app requested consent to access resource <resourceAppDisplayName>. This request failed because it doesn't match how the app was pre-configured during app registration. Contact the app vendor.**
59
59
60
-
These errors all occur when the application a user is trying to consent to is requesting permissions to access a resource application that cannot be found in the organization’s directory (tenant). This situation can occur for several reasons:
60
+
These errors all occur when the application a user is trying to consent to is requesting permissions to access a resource application that can't be found in the organization’s directory (tenant). This situation can occur for several reasons:
61
61
62
62
* The client application developer has configured their application incorrectly, causing it to request access to an invalid resource. In this case, the application developer must update the configuration of the client application to resolve this issue.
63
63
64
-
* A Service Principal representing the target resource application does not exist in the organization, or existed in the past but has been removed. To resolve this issue, a Service Principal for the resource application must be provisioned in the organization so the client application can request permissions to it. The Service Principal can be provisioned in a number of ways, depending on the type of application, including:
64
+
* A Service Principal representing the target resource application doesn't exist in the organization, or existed in the past but has been removed. To resolve this issue, a Service Principal for the resource application must be provisioned in the organization so the client application can request permissions to it. The Service Principal can be provisioned in many ways, depending on the type of application, including:
65
65
66
66
* Acquiring a subscription for the resource application (Microsoft published applications)
67
67
@@ -74,13 +74,13 @@ These errors all occur when the application a user is trying to consent to is re
74
74
## Risky app error and warning
75
75
76
76
***AADSTS900941:** Administrator consent is required. App is considered risky. (AdminConsentRequiredDueToRiskyApp)
77
-
* This app may be risky. If you trust this app, please ask your admin to grant you access.
77
+
* This app may be risky. If you trust this app, ask your admin to grant you access.
78
78
***AADSTS900981:** An admin consent request was received for a risky app. (AdminConsentRequestRiskyAppWarning)
79
79
* This app may be risky. Only continue if you trust this app.
80
80
81
-
Both of these messages will be displayed when Microsoft has determined that the consent request may be risky. Among a number of other factors, this may occur if a [verified publisher](../develop/publisher-verification-overview.md)has not been added to the app registration. The first error code and message will be shown to end-users when the [Admin consent workflow](configure-admin-consent-workflow.md) is disabled. The second code and message will be shown to end-users when the admin consent workflow is enabled and to admins.
81
+
Both of these messages will be displayed when Microsoft has determined that the consent request may be risky. Among many other factors, this may occur if a [verified publisher](../develop/publisher-verification-overview.md)hasn't been added to the app registration. The first error code and message will be shown to end-users when the [Admin consent workflow](configure-admin-consent-workflow.md) is disabled. The second code and message will be shown to end-users when the admin consent workflow is enabled and to admins.
82
82
83
-
End-users will not be able to grant consent to apps that have been detected as risky. Admins are able to, but should evaluate the app very carefully and proceed with caution. If the app seems suspicious upon further review, it can be reported to Microsoft from the consent screen.
83
+
End-users won't be able to grant consent to apps that have been detected as risky. Admins are able to, but should evaluate the app carefully and proceed with caution. If the app seems suspicious upon further review, it can be reported to Microsoft from the consent screen.
There may be situations while configuring or managing an application where you don't want tokens to be issued for an application. Or, you may want to preemptively block an application that you do not want your employees to try to access. To accomplish this, you can disable user sign-in for the application, which will prevent all tokens from being issued for that application.
20
+
There may be situations while configuring or managing an application where you don't want tokens to be issued for an application. Or, you may want to block an application that you don't want your employees to try to access. To block user access to an application, you can disable user sign-in for the application, which will prevent all tokens from being issued for that application.
21
21
22
-
In this article, you will learn how to prevent users from signing in to an application in Azure Active Directory through both the Azure portal and PowerShell. If you are looking for how to block specific users from accessing an application, use [user or group assignment](./assign-user-or-group-access-portal.md).
22
+
In this article, you'll learn how to prevent users from signing in to an application in Azure Active Directory through both the Azure portal and PowerShell. If you're looking for how to block specific users from accessing an application, use [user or group assignment](./assign-user-or-group-access-portal.md).
23
23
24
24
25
25
@@ -42,9 +42,9 @@ To disable user sign-in, you need:
42
42
43
43
## Use Azure AD PowerShell to disable an unlisted app
44
44
45
-
Ensure you have installed the AzureAD module (use the command Install-Module -Name AzureAD). In case you are prompted to install a NuGet module or the new Azure Active Directory V2 PowerShell module, type Y and press ENTER.
45
+
Ensure you've installed the AzureAD module (use the command Install-Module -Name AzureAD). In case you're prompted to install a NuGet module or the new Azure Active Directory V2 PowerShell module, type Y and press ENTER.
46
46
47
-
If you know the AppId of an app that doesn't appear on the Enterprise apps list (for example, because you deleted the app or the service principal hasn't yet been created due to the app being pre-authorized by Microsoft), you can manually create the service principal for the app and then disable it by using the cmdlet below.
47
+
You may know the AppId of an app that doesn't appear on the Enterprise apps list. For example, you may have deleted the app or the service principal hasn't yet been created due to the app being pre-authorized by Microsoft), you can manually create the service principal for the app and then disable it by using the following cmdlet.
0 commit comments