CODEWITHSUNDEEP
azure-active-directorymicrosoft-graph-api
Jeff McKay
Jeff McKay

Reputation: 171

Giving access to third party application

I am a developer working on an application that will access O365 data via the Graph API. I have registered an application under my company account. I have authentication working on a per-user basis. Now I am trying to get it to work so that a tenant administrator can grant permission to my application for data access on an organization-wide basis. I have this working as well - I used the /adminconsent endpoint to bring the administrator to a page where he granted the consent.

What I am wondering about is the line in the documentation that says "You can rely on an administrator to grant the permissions your app needs at the Azure portal". I am trying to figure out what that procedure is so I can document it for admin users. I thought perhaps it was to go to App Registrations - there I see an option to create a new registration. But this has it's own Client Id. Don't I somehow have to give it the Client Id of my own application? Or is the idea that the tenant admin will supply the Client Id of his app to my app? Or am I in the wrong area altogether?

BTW in case it is relevant, I am not using any authentication library, just making direct http calls from a C++ program running on the Windows desktop.

Upvotes: 2

Views: 945

Answers (1)

Tony Ju
Tony Ju

Reputation: 15609

Per my understanding, your application is an multi-tenant application. Only you or the administrators in your tenant can grant the permissions to your application. The administrators from other tenants can grant consent to use your application, but they can not control the permissions.

Update:

You can grant admin consent by calling admin consent endpoint.

https://login.microsoftonline.com/common/v2.0/adminconsent?
  client_id={your_tenant_client_id}
  &state=12345
  &redirect_uri=http://localhost/myapp/permissions
    &scope=
    https://graph.microsoft.com/.default

If you want to grant admin consent via Azure portal. The application must already been provisioned in your tenant. For example, an app could be provisioned in your tenant if at least one user has already consented to the application.

Upvotes: 1

Related Questions