我有一个企业应用程序，需要漂亮的名义权限：
我已经同意为管理员。
当用户尝试访问应用程序并登录时，他们会收到此消息：
”需要访问组织中只能授予管理员的资源。
我不希望我的用户看到此消息（他们会致电helpdesk或做错事）。
我认为我上面提供的管理员同意应该足够，所以我的问题是：
- 可以代表用户同意
- 我需要更改的设置吗？
I have an Enterprise Application which requires pretty nominal permissions:
I have already granted consent as an admin.
When a user tries to access the app and logs-in they get this message:
"needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it."
I don't want my users to see this message (they will call helpdesk or do the wrong thing).
I think the admin consent I provided above should be sufficient, so my questions are:
- Is is possible to consent on behalf of the users
- What settings to I need to change?
发布评论
评论（1）
是的，可以代表用户同意。要实现相同的目标，您必须拥有
全局管理员或特权管理员角色。转到Azure Portal -＆gt; Azure Active Directory-＆GT;企业应用程序 - ＆GT;同意和权限 - ＆GT;用户同意设置
输入映像”
参考：
授予授予范围范围范围的管理员同意 - Microsoft Entra | Microsoft Docs
Azure Ad应用需要管理批准错误：应用程序需要许可以访问组织中只能授予的组织中的资源 - 堆栈溢出
Yes, it is possible to consent on behalf of the users. To achieve the same you must have
Global AdministratororPrivileged Administratorrole.Go to Azure Portal -> Azure Active Directory -> Enterprise applications -> Consent and permissions - > User consent settings
Check if the below option is set to No in Enterprise Application Users settings:
References:
Grant tenant-wide admin consent to an application - Microsoft Entra | Microsoft Docs
Azure AD app Need admin approval error: App needs permission to access resources in your organization that only an admin can grant - Stack Overflow