I choose some API for my app, but some permission needs an admin to consent, but how do I contact an admin? Is there an user type named "admin" so I can contact those users?
2 Answers
There is currently no easy way to identify administrator contacts for a tenant. However it's very easy to get that information programmatically. I wrote a short blog post with some source code in http://www.cloudidentity.com/blog/2017/08/13/whos-your-admin/, but in a nutshell: you need to get https://graph.windows.net/myorganization/directoryRoles/{0}/members, where {0} is the objectID of the administrator role in your directory.
-
Thanks a lot, your blog is great! But I use Azure AD Graph Explorer to find directory roles instead. Aug 16, 2017 at 5:49
-
Did you try the code I posted? That should give you the right admin.– vibronetAug 16, 2017 at 5:50
-
I read the blog, and I think "company administrator" is whom I want to contact. I can find it in the roles list. Aug 16, 2017 at 5:53
-
When I executed the code, i got the below error. {"odata.error":{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Insufficient privileges to complete the operation."}}} Does the approach work now? Sep 22, 2017 at 2:04
-
Are you using the same clientID as the sample, or did you paste the code in some other app? Generic users should be able to access that info, but your app needs to be able to access the directory as the user... and that can only happen with a native client. If you are indeed using the exact same app, maybe your tenant admin added extra constraints.– vibronetSep 22, 2017 at 3:48
App-only permissions always require a tenant administrator’s consent , and certain delegated permissions also require a tenant administrator’s consent. For example, the ability to write back to Azure AD as the signed in user requires a tenant administrator’s consent.
Only a user that authenticates with an account that belongs to the Global Admin role can provide consent; others will receive an error. You could check Directory role of a user , if the value is Global administrator , the user account belongs to the Global Admin role :
