Admin consent not applying for multi-tenant app

Question

Admin consent not applying for multi-tenant app

Oguz Gelal 5

Hello!

We are experiencing an issue with our multi-tenant app.

Admin consent URL is being used correctly: https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}&scope=Mail.Send%20User.Read%20offline_access

Admin is a Global Administrator.

All required permissions are delegated (Mail.Send, User.Read, offline_access).

App is multi-tenant and the redirect URI is correctly registered.

Users still see repeated consent requests after admin approval, even in clean browsers.

We have verified that the admin has clicked the consent link, but the consent does not seem to apply properly for users.

Has anyone encountered this behavior, or is there a recommended way to ensure tenant-wide admin consent applies correctly for v2.0 multi-tenant apps?

Thank you for any guidance.

Carolyne Milgo 1,151 Reputation points

2025-10-02T18:50:25.7366667+00:00

This is somewhat strange. Could be a propagation delay but this should be intermittent especially if all permissions have been admin consented and there are no additional permissions added after the admin consent that would still require consent.

Can you confirm that the redirect URI configured matches the login flow.
Oguz Gelal 5 Reputation points

2025-10-02T21:34:08.0766667+00:00

Thanks for your response! I can confirm that the redirect URI is configured correctly and matches the login flow exactly ( looks like https://app.******.com/outlook).

One thing I’m wondering about: could the fact that our app is not yet verified (unpublished / unverified in Azure) be related to this behavior? In other words, is app verification required for tenant-wide admin consent to apply properly, or should unverified apps work the same way?

Thanks again for the help!

Your answer

Carolyne Milgo 1,151 Reputation points

2025-10-02T18:50:25.7366667+00:00

This is somewhat strange. Could be a propagation delay but this should be intermittent especially if all permissions have been admin consented and there are no additional permissions added after the admin consent that would still require consent.

Can you confirm that the redirect URI configured matches the login flow.
Oguz Gelal 5 Reputation points

2025-10-02T21:34:08.0766667+00:00

Thanks for your response! I can confirm that the redirect URI is configured correctly and matches the login flow exactly ( looks like https://app.******.com/outlook).

One thing I’m wondering about: could the fact that our app is not yet verified (unpublished / unverified in Azure) be related to this behavior? In other words, is app verification required for tenant-wide admin consent to apply properly, or should unverified apps work the same way?

Thanks again for the help!