Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Application needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it #29197

Closed
rajmusuku opened this issue Apr 11, 2019 · 23 comments
Closed

Application needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it #29197

rajmusuku opened this issue Apr 11, 2019 · 23 comments
Assignees
@DerekHerman-MSFT
Labels
common/subsvc cxp Pri2 product-question review-team-triage storage/svc triaged

Comments

@rajmusuku
Copy link

rajmusuku commented Apr 11, 2019 •
edited by KetanChawda-MSFT

Followed all the steps as mentioned in doc, however I see an issue of admin consent although the storage account was created by me. Here is the error notification.
"Application needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it"

  • Is it required that the registered app would need Admin consent although the storage account is created by a user?
  • Should we always use the resource id as "https://storage.azure.com/"? Will it be changed ever since the id would be different for each storage account

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.
@KetanChawda-MSFT
Copy link

@rajmusuku Can you please share the link to the document which you are referring so that we can assign it to the correct team.

@rajmusuku
Copy link
Author

https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-app

@KetanChawda-MSFT
Copy link

@rajmusuku Thank you for the details. We will review and provide an update as appropriate.

@YASWANTHM-MSFT
Copy link

@rajmusuku , The easiest way to allow your service account to connect is to enable user access to Enterprise apps. From your Admin portal, go to Admin Centers > Azure AD > Users and Groups > User Settings then make sure "Users can consent to apps accessing company data on their behalf" is enabled.
If this option is set to yes, then non-admin users may register custom-developed applications for use within this directory. If this option is set to no, then only users with an administrator role may register these types of applications.
image

@YASWANTHM-MSFT
Copy link

@rajmusuku, We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

@patriziobruno
Copy link

patriziobruno commented Jun 22, 2019 •
edited

Hi @YASWANTHM-MSFT, I am having the same issue as @rajmusuku's and Admin Centers > Azure AD > Users and Groups > User Settings > "Users can consent to apps accessing company data on their behalf" is already enabled. I want to enable AAD authentication for my Azure Storage Account blobs archive

@patriziobruno
Copy link

@YASWANTHM-MSFT I sorted this out with my org's admin, thanks!

@YASWANTHM-MSFT
Copy link

Glad to know that your issue is resolved.

@wisepotato
Copy link

Any idea how to solve this?

@Jaffacakes82
Copy link
Contributor

@YASWANTHM-MSFT I sorted this out with my org's admin, thanks!

What did you do with your organisation admin to resolve this?

@Karthiktandra
Copy link

Can you please help me with the issue. Can I know what you have done with your Org's Admin to resolve this @YASWANTHM-MSFT

@Karthiktandra Karthiktandra mentioned this issue Jul 24, 2019
Closed
@wisepotato
Copy link

Image of xkcd

@patriziobruno
Copy link

patriziobruno commented Jul 25, 2019 •
edited

@Karthiktandra your Azure Active Directory Admin must grant admin consent to your app for some azure api, using the button Grant admin consent for Application at the bottom of the API Permissions blade:

image

@tamram
Copy link
Contributor

tamram commented Jul 25, 2019

To address this part of the original question:

Should we always use the resource id as "https://storage.azure.com/"? Will it be changed ever since the id would be different for each storage account

You can use the storage account root URI as the resource ID. We've recently updated the documentation to add this information. For example, see Well-known values for authentication with Azure AD.

@Karthiktandra
Copy link

Hi @patriziobruno,

Thanks for the information, I will make the relevant changes.

@AbhaPatankar
Copy link

I am getting the same error. I wanted to understand how can I find out the admin name for my org to login to azure active directory admin portal. This is bit urgent and help here will be highly appreciated.

@AbhaPatankar
Copy link

Any updates here?

@Karthiktandra
Copy link

Hi @AbhaPatankar ,

Please check in Subscriptions- Access Control - Classic Admin.

List of admins will be visible there.

You can ask the global admin to grant the permission.

@AbhaPatankar
Copy link

AbhaPatankar commented Nov 28, 2019 via email

@AbhaPatankar
Copy link

AbhaPatankar commented Dec 2, 2019 via email

@ketan-chawda-msft ketan-chawda-msft mentioned this issue Jan 21, 2020
Closed
@AveryData
Copy link

was there a conclusion?

@chrishna1
Copy link

If, by any chance, you found this issue while configuring rclone to use your company's onedrive account. The answer you need, lies here.

You're welcome.

@gabriel-alcantara
Copy link

as @patriziobruno said, I needed the admin consent in my api permissions and it works perfectly on msdal lib to angular

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@DerekHerman-MSFT DerekHerman-MSFT

Labels
common/subsvc cxp Pri2 product-question review-team-triage storage/svc triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests