search

azure-ad-b2c / samples

Azure AD B2C custom policy solutions and samples.
840 stars 597 forks source link

Can not grant admin consent. Your organization does not have a subscription(or service principle) for the following API(s).. #142

Closed jkears closed 3 years ago

jkears commented 3 years ago

I created a B2C Tenant and added a B2C Application ("nextware_code_generator") that is used to automate the creation of other B2C Applications for a several ASP.Net Web API apps. I added the following API permissions to the nextware_code_generator as follows; image

I created a .Net console app that runs as the above B2C ("nextware_code_generator") app which successfully creates a number of B2C Applications as per 4 existing ASP.Net Web API applications as follows;

image

The above mentioned console app uses the Graph API to programmatically create each of the B2C applications and adds the scopes to each API's B2C app as well it adds all the necessary API permissions on each B2C application necessary to call other API service methods. This all seems to work and is reflected in the Azure Portal.

For example the nextware.productportal.coreservices.api B2C Application requires the following API permissions from two of the other Web API applications (4 scope items from nextware.productportal.sharedservices.api and (1 scope item from nextware.productportal.workspace.api). This is how the the API Permissions view looks like in Azure B2C once the console application has completed it's work.

Note the permissions to the other two APIs...

image

However when I attempt to manually grant consent these new permissions as Global Admin I am not able to and see the following error message...

image

  1. Why do I receive this error?
  2. Is it possible to programmatically grant the above permissions via the the console app running as nextware_code_generator ?
JasSuri commented 3 years ago

Likely you only created Application Registrations, without coresspinding servicePrincipals. This question really should go onto StackOverflow Azure AD and MS Graph API tags for the best advice. I will close this since its not related to any of the Custom Policies in this repo.