search

MicrosoftDocs / azure-docs

Open source documentation of Microsoft Azure
https://docs.microsoft.com/azure
Creative Commons Attribution 4.0 International
10.21k stars 21.36k forks source link

Admin Consent Prerequisites #43860

Closed sandytsang closed 4 years ago

sandytsang commented 4 years ago

Documentation said "Granting admin consent requires you to sign in as global administrator, an application administrator, or a cloud application administrator". But when I tested remove a admin from Global administrator role, added as application administrator and cloud application administrator, grant admin consent is no longer available.

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

AshokPeddakotla-MSFT commented 4 years ago

@sandytsang Thanks for the feedback! We are currently investigating and will update you shortly.

ManojReddy-MSFT commented 4 years ago

@sandytsang I am able to consent to applications with just the application administrator role. Can you post a screenshot of what you see in the portal with and without the GA role assigned to your user account?

sandytsang commented 4 years ago

@ManojReddy-MSFT Hello, just tested this again. When the user is only has application administrator role, create a new application, assigned Microsoft Graph DeviceManagementConfiguration.ReadWrite.All "Application Permission" (Not delegated permission), click on Grant Admin Consent, it gave error. Logout from Azure Portal, then login again, open the same application, Grant admin consent is greyed out.

No issues with Intune Dataware API house get_data_warehouse application permission or OneNote application API application permission.

ManojReddy-MSFT commented 4 years ago

@sandytsang Application Administrator role actually has an exception for permissions related to Graph.

This role also grants the ability to consent to delegated permissions and application permissions, with the exception of permissions on the Microsoft Graph and Azure AD Graph

Ref: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#application-administrator

sandytsang commented 4 years ago

@ManojReddy-MSFT oh. thank you! Can we add this as additional note in this admin consent page?

ManojReddy-MSFT commented 4 years ago

@sandytsang I have added a line about this limitation in the doc and submitted a PR. The issue will be updated when the PR gets merged.

sandytsang commented 4 years ago

Thank you very much!