CODEWITHSUNDEEP
azureazure-active-directorymulti-tenant
bater
bater

Reputation: 97

Azure Admin Consent in multi tenant not working

I've some problems with the admin consent in a multi tenant environment. So here is my structur.

I've got registered one ActiveDirectory Aapp in Tenant 1, called "App1". In this App, I set i.e. permissions for Microsoft Graph. Then I granted this permission.

Now I want to have also this App1 in my Tenant 2, so I do an AdminConsent with: https://login.microsoftonline.com/TenantID_of_Tenant2/adminconsent?client_id=ClientID_of_App1

It worked fine. A few minutes later I saw App1 in Tenant2 and I was able i.e. to give access right to App1 for Users of Tenant2. No problem.

So then I had to give my App1 a few more permissions. So I clicked "App registrations" in Tenant1 and gave more permissions for Microsoft Graph. Then I clicked to "Enterprise Applications" in Tenant1, selected my App1 -> Permission and then "Grant admin consent for tenant1". A new browser was opened and I was able to do the admin consent for App1 in Tenant1.

Then I thought that I have to do the same in Tenant2, because it works the first time. So in Tenant2 I also navigated to ActiveDirectory -> Enterprise Applications -> selected my App1 -> Permissions Here I saw the first permissions which I granted. Then I clicked to "Grant admin consent for Tenant2". A new browser was opened, but now it failed with folowwing error: https://myRedirectURL/?error=access_denied&error_description=AADSTS65005%3a+The+application+%clientID_of_App1%27+asked+for+permissions+to+access+a+resource+that+has+been+removed+or+is+no+longer+available.+Contact+the+app+vendor.%0d%0aTrace+ID%TraceID%0d%0aCorrelation+ID%CorrelationIDaTimestampTimestamp&admin_consent=True&tenant=TenantID_of_Tenant2

Better to read: Error:

"AADSTS65005. The application ID_App1 asked for permissions to access a resource that has been removed or is no longer available. Contatct the app vendor."

I get the same error when I invoke the URL https://login.microsoftonline.com/TenantID_of_Tenant2/adminconsent?client_id=ClientID_of_App1

But I didn't do anything...so wheres the problem?

Upvotes: 0

Views: 997

Answers (1)

Marilee Turscak - MSFT
Marilee Turscak - MSFT

Reputation: 7728

For your Redirect URI error you can try these steps:

  1. Set the resource in your request to Azure AD.
  2. Ensure that the client Id of the WebApp is configured in the WebApi's "knowClientApplications" array property in the manifest file
  3. Ensure that all permissions are correct (APIs are added as delegated permissions to the client).
  4. Ensure that all services (web app & apis) are multi tenant
  5. Update manifest with:
"availableToOtherTenants": true,
  "knownClientApplications": [
    "{client app application id}"
  ],

See also the troubleshooting steps in these similar threads:

Azure AD error when fetching access token & login

The client application has requested access to resource 'https://outlook.office365.com'. This request has failed

Upvotes: 1

Related Questions