Azure AD SSO: Allow to get bootstrap token without granting admin consent

Piyumi Perera 101

I am using SSO with Azure AD v2 for Office365 Addin. I registered an azure app using account1@domain1.com by following register-sso-add-in-aad-v2.

I was able to get bootstrap token using OfficeRuntime.auth.getAccessToken() without consenting.

I was unable to get bootstrap token, when I tried to use account2@domain2.com. I got following error which is expected according to the documentation (Outlook-Add-in-SSO).

code: 13005  
message: "Missing grant for this add-in."  
name: "Preauthorization missing."

I need to understand these two behaviors.

I have added following permissions to azure app.

AmanpreetSingh-MSFT 56,311 Reputation points

2021-09-23T12:15:05.18+00:00

@Piyumi Perera • Can you share the authentication request URL i.e., starting with https://login.microsoftonline.com for both account1 and account2, hiding your confidential information. You can capture that using Fiddler tool. I suspect that the token acquisition call by the account2 includes scopes which requires admin consent.