"Allow user consent for apps from verified publishers, for selected permissions" setting doesn't work

Question

"Allow user consent for apps from verified publishers, for selected permissions" setting doesn't work

Lucid Software 0

Screenshot from 2025-09-25 17-49-36

I've set the above setting on my Entra instance. I want users on this account to be able to grant access to an app with scopes that I've classified as 'low_impact' in the permissions classification.

However, when I test with a user on my account I still get this message about admin authorization being required

Screenshot from 2025-09-25 16-46-05

As you can see from the screenshot, the app is verified. Any idea what could be wrong? We're running into the issue internally and with our customers who use our app.

Anonymous

2025-09-26T08:34:52.7233333+00:00

Hello Lucid Software,
As per your description we can see you have already on the correct path.
I will suggest you to check one more point, that will be user.read API permission.
you need to add user.read API permission in the permission classifications blade:

Then try to sign in again, you can refer the similar question too:
https://stackoverflow.com/questions/78023687/azure-entra-id-authentication-requiring-admin-consent
Hope this help!
Please reach out to us again if you need further assistance on this issue. happy to help!

Regards,

Monalisha
Lucid Software 0 Reputation points

2025-09-26T17:45:32.7333333+00:00

Hi @Monalisha Jena

We've tried classifying User.Read permissions as low impact, but we're still seeing the admin approval required message. Do you have any other idea to troubleshoot, or should we file a bug report?
Anonymous

2025-09-30T08:26:06.7566667+00:00

Hello Lucid Software,
If you've already classified User.Read as low impact and still see the admin consent prompt, double-check that:
The app is only requesting delegated permissions (not application permissions).

Your tenant-wide consent settings allow user consent for verified apps with low-impact scopes.

The exact permission name matches what’s classified.

If all checks pass and the issue persists, filing a bug report is a good next step.

thanks

Your answer

Anonymous

2025-09-26T08:34:52.7233333+00:00

Hello Lucid Software,
As per your description we can see you have already on the correct path.
I will suggest you to check one more point, that will be user.read API permission.
you need to add user.read API permission in the permission classifications blade:

Then try to sign in again, you can refer the similar question too:
https://stackoverflow.com/questions/78023687/azure-entra-id-authentication-requiring-admin-consent
Hope this help!
Please reach out to us again if you need further assistance on this issue. happy to help!

Regards,

Monalisha
Lucid Software 0 Reputation points

2025-09-26T17:45:32.7333333+00:00

Hi @Monalisha Jena

We've tried classifying User.Read permissions as low impact, but we're still seeing the admin approval required message. Do you have any other idea to troubleshoot, or should we file a bug report?
Anonymous

2025-09-30T08:26:06.7566667+00:00

Hello Lucid Software,
If you've already classified User.Read as low impact and still see the admin consent prompt, double-check that:
The app is only requesting delegated permissions (not application permissions).

Your tenant-wide consent settings allow user consent for verified apps with low-impact scopes.

The exact permission name matches what’s classified.

If all checks pass and the issue persists, filing a bug report is a good next step.

thanks