2

I choose some API for my app, but some permission needs an admin to consent, but how do I contact an admin? Is there an user type named "admin" so I can contact those users?

1
  • The admin user that can consent to the API use is someone in your own organization who has administrative privileges in Azure Active Directory. You should probably contact your corporate IT.
    – RasmusW
    Aug 11, 2017 at 11:47

2 Answers 2

1

There is currently no easy way to identify administrator contacts for a tenant. However it's very easy to get that information programmatically. I wrote a short blog post with some source code in http://www.cloudidentity.com/blog/2017/08/13/whos-your-admin/, but in a nutshell: you need to get https://graph.windows.net/myorganization/directoryRoles/{0}/members, where {0} is the objectID of the administrator role in your directory.

5
  • Thanks a lot, your blog is great! But I use Azure AD Graph Explorer to find directory roles instead. Aug 16, 2017 at 5:49
  • Did you try the code I posted? That should give you the right admin.
    – vibronet
    Aug 16, 2017 at 5:50
  • I read the blog, and I think "company administrator" is whom I want to contact. I can find it in the roles list. Aug 16, 2017 at 5:53
  • When I executed the code, i got the below error. {"odata.error":{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Insufficient privileges to complete the operation."}}} Does the approach work now? Sep 22, 2017 at 2:04
  • Are you using the same clientID as the sample, or did you paste the code in some other app? Generic users should be able to access that info, but your app needs to be able to access the directory as the user... and that can only happen with a native client. If you are indeed using the exact same app, maybe your tenant admin added extra constraints.
    – vibronet
    Sep 22, 2017 at 3:48
0

App-only permissions always require a tenant administrator’s consent , and certain delegated permissions also require a tenant administrator’s consent. For example, the ability to write back to Azure AD as the signed in user requires a tenant administrator’s consent.

Only a user that authenticates with an account that belongs to the Global Admin role can provide consent; others will receive an error. You could check Directory role of a user , if the value is Global administrator , the user account belongs to the Global Admin role : enter image description here

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.