Recently, I had built an AAD application in my tenant with
the permission “Enable single sign-on and read user’s profile”.
The application didn’t have admin consent so any time a user
would login to my site, he would be asked for consent. I had some users who had
consented to my app.
After some time, I added another permission “Access Azure
Service Management” to my app and I was able to login fine. Users who had never
consented to my app earlier could also sign in. However, users who had already
consented to my app before I added the new permission started seeing this error
“AADSTS65001: No permission to access user information is configured for xxx'
application, or it is expired or revoked. “
I was really confused why the app works for some users but
not for others.
After understanding the pattern that the error occurs only
for users who had already consented, I asked them to perform the following work
around:
- Go to https://myapps.microsoft.com
- Remove the app
- Sign in again to the app in a fresh browser session
- Now you will see the consent prompt for two permission
- Grant consent
After this, all users were able to login successfully.
No comments:
Post a Comment