Some users which belongs to another teenant are not able to login using our app with SingelSignOn

Question

How can another user login using our app using Singel Sign On. When User login then admin need to give permission.

Question: What is needed for admin to give permission to our "app" and how to do that? The app is registered and works for some users but sometimes it ask new user to accept the app login with admin permission. How to approve the app and it stop asking for approvement all the time. Please see attached image

Answer 1

Hello Fredrik Bålstedt,

Thank you for posting your question in the Microsoft Q&A Community.

From my understanding, guest users cannot access an application due to approval issues.

Please be informed that this results from the User consent for application settings in your tenant being set to No.

There are a few ways to resolve this;

Firstly, Since you would like to approve permissions to the application without the need to always request consent, Admin can grant tenant-wide admin consent in the Enterprise App Pane.

Follow the link for more information. https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal#grant-tenant-wide-admin-consent-in-enterprise-apps-pane

Secondly, you can change the User consent setting to Allow user Consent for app from verified publishers by going to the User setting under Enterprise Application blade

Lastly, Under the Admin consent settings, you can allow users to request admin consent to apps and you can add the reviewers of this consent under the Users and Groups tabs as shown in the image below.

With this in place, the admin will approve access to the application.

Let me know if further assistance is needed.

Babafemi

Answer 2

Hi @Fredrik Bålstedt

Thank you for post!

To answer your question, in the context of an application, particularly within Microsoft Entra ID, is a process where a privileged administrator grants permission to an application to access specific resources or data on behalf of all users within an organization. This is often required for applications that need to perform actions or access data that are beyond the scope of individual user permissions.
To manage admin approval for an app using Single Sign-On (SSO), you typically need to adjust the consent settings within your admin portal.

If the app is trusted and you want to avoid repeated consent prompts, you can grant tenant-wide admin consent.
If you prefer not to grant tenant-wide consent, you can adjust the user consent settings to allow users to consent to apps on their own. https://learn.microsoft.com/en-us/microsoft-365/admin/misc/user-consent?view=o365-worldwide

Hope this helps. Do let us know if you any further queries.

Thanks,
Akhilesh.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.