azureopenid-connectmicrosoft-entra-id

How to skip admin approval for external users in an Entra ID multi-tenant application

I have an application using MS Entra authentication using OpenIdConnect deployed on Azure. My Azure App is configured as a multi-tenant. I do not have any Token configurations, and the app has the API permission User.Read:

enter image description here

When external users try to login using SSO, they are prompted with an Approval Request. Is there any way to skip the admin approval and proceed to my application (maybe via self-approval)?

enter image description here

AzureSettings

"AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "TenantId": "organizations",
    "ClientId": " - - - - ",
    "ClientSecret": " ~ ",
    "Domain": "domain.onmicrosoft.com",
    "CallbackPath": "/signin-azuread-oidc"
},

If I add the external users as guests to my environment, then it appears to be OK, but I'm looking for other options.

Solution

  • Initially, I registered one multi-tenant application and granted User.Read permission of Delegated type as below:

    enter image description here

    When I tried to login with user account from different tenant (external user), I too got "Approval required" screen as below:

    enter image description here

    This happens if the admin of external user tenant enabled below option in Enterprise Applications tab:

    enter image description here

    To stop "Approval required" screen, you need to disable above option in external user organization logging as Admin user like this:

    enter image description here

    If you want the user to self-approve the consent screen and proceed to application, make sure to enable below option in external user organization:

    enter image description here

    When I tried to login again with external user account now, I got consent screen to accept as below without asking for justification:

    enter image description here

    Reference: Microsoft Social Login Approval Required Popup - Stack Overflow by me