Service Principal

Question

Service Principal

pattifree 46

I have created a Multitenant service principal in tenant A. I need to give this service principal access to tenant B(B2C). I have https://login.microsoftonline.com/tenantId/adminconsent?client_id=000000000000 I get the content successfully. the issue is it wants a redirect URL. I have no idea what that could be.

Hoping that someone can point in the right direction.

Thanks,

Patti

Siva shunmugam Nadessin 10,905 Reputation points Microsoft External Staff Moderator

2025-10-28T17:58:28.7833333+00:00
Hello pattifree,

Kindly reply to below questions for us to investigate further.

Have you already registered the service principal in Tenant B, or is it just in Tenant A?

Are you trying to grant access to specific APIs in Tenant B? If so, which ones?

Do you have the necessary permissions in both tenants to perform these operations?
pattifree 46 Reputation points

2025-10-28T18:36:45.77+00:00
Have you already registered the service principal in Tenant B, or is it just in Tenant A? Just in Tenant A

Are you trying to grant access to specific APIs in Tenant B? If so, which ones? I want service principal in tenant A to connect to Tenant B(B2C) to scan the service principals for secrets that are near expiry or expired.

Do you have the necessary permissions in both tenants to perform these operations? I am a global admin in both tenants.

Thanks
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-28T19:03:41.02+00:00

Hello pattifree,

Thank you for posting your question in the Microsoft Q&A Forum.

The redirect URI is required because after granting admin consent, Azure AD needs a valid endpoint to send the response. You can add a placeholder like https://localhost or your app’s actual URL in the Authentication section of the app registration in tenant A. Then, include that same URI in your admin consent link:

https://login.microsoftonline.com/{tenantB}/adminconsent?client_id={clientId}&redirect_uri=https://localhost

Make sure the redirect URI exactly matches one of those configured in the app registration.

For more details, please refer to the document:

https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-redirect-uri

https://learn.microsoft.com/en-us/entra/identity-platform/v2-admin-consent

If you need any additional information or further assistance, please let me know.
pattifree 46 Reputation points

2025-10-28T19:09:00.7733333+00:00

@vemula srisai I tried that and I get the following localhost refused to connect.
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-29T21:51:59.9766667+00:00

pattifree The message “localhost refused to connect” occurs because https://localhost is only a placeholder and doesn’t point to an active endpoint — so the browser shows that message after redirection.

You can replace it with your actual redirect URI based on your app’s requirement (for example, your application URL or any valid redirect endpoint you have configured).

Even though the browser shows that “localhost refused to connect”, the admin consent has already been granted successfully. You are being redirected back after the consent process completes.

Please check under Azure Portal → Tenant B → Enterprise Applications and confirm that your app (from Tenant A) appears there. If it does, that means the admin consent was successful.
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-11-04T01:25:54.68+00:00

pattifree Just checking in to see if you had a chance to verify whether the application from Tenant A now appears under Azure Portal → Tenant B → Enterprise Applications.

If it’s listed there, that confirms the admin consent process completed successfully, and the “localhost refused to connect” message can safely be ignored as it was only due to the placeholder redirect URI.
Carolyne Milgo 1,151 Reputation points

2025-11-05T09:45:09.9933333+00:00

A redirect URI is where the Microsoft identity platform sends security tokens after authentication. Redirect URIs are configured in Platform configurations in the Microsoft Entra admin center. For Web and Single-page applications, you need to specify a redirect URI manually. For Mobile and desktop platforms, you select from generated redirect URIs.
Basically, the redirect URI is where you expect the user to land once they successfully complete authentication.
In the case of AzureAD B2C-use this documentation to guide you- https://learn.microsoft.com/en-us/azure/active-directory-b2c/tutorial-register-applications

Your answer

Siva shunmugam Nadessin 10,905 Reputation points Microsoft External Staff Moderator

2025-10-28T17:58:28.7833333+00:00

Hello pattifree,

Kindly reply to below questions for us to investigate further.

Have you already registered the service principal in Tenant B, or is it just in Tenant A?

Are you trying to grant access to specific APIs in Tenant B? If so, which ones?

Do you have the necessary permissions in both tenants to perform these operations?
pattifree 46 Reputation points

2025-10-28T18:36:45.77+00:00

Have you already registered the service principal in Tenant B, or is it just in Tenant A? Just in Tenant A

Are you trying to grant access to specific APIs in Tenant B? If so, which ones? I want service principal in tenant A to connect to Tenant B(B2C) to scan the service principals for secrets that are near expiry or expired.

Do you have the necessary permissions in both tenants to perform these operations? I am a global admin in both tenants.

Thanks
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-28T19:03:41.02+00:00

Hello pattifree,

Thank you for posting your question in the Microsoft Q&A Forum.

The redirect URI is required because after granting admin consent, Azure AD needs a valid endpoint to send the response. You can add a placeholder like https://localhost or your app’s actual URL in the Authentication section of the app registration in tenant A. Then, include that same URI in your admin consent link:

https://login.microsoftonline.com/{tenantB}/adminconsent?client_id={clientId}&redirect_uri=https://localhost

Make sure the redirect URI exactly matches one of those configured in the app registration.

For more details, please refer to the document:

https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-redirect-uri

https://learn.microsoft.com/en-us/entra/identity-platform/v2-admin-consent

If you need any additional information or further assistance, please let me know.
pattifree 46 Reputation points

2025-10-28T19:09:00.7733333+00:00

@vemula srisai I tried that and I get the following localhost refused to connect.
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-29T21:51:59.9766667+00:00

pattifree The message “localhost refused to connect” occurs because https://localhost is only a placeholder and doesn’t point to an active endpoint — so the browser shows that message after redirection.

You can replace it with your actual redirect URI based on your app’s requirement (for example, your application URL or any valid redirect endpoint you have configured).

Even though the browser shows that “localhost refused to connect”, the admin consent has already been granted successfully. You are being redirected back after the consent process completes.

Please check under Azure Portal → Tenant B → Enterprise Applications and confirm that your app (from Tenant A) appears there. If it does, that means the admin consent was successful.
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-11-04T01:25:54.68+00:00

pattifree Just checking in to see if you had a chance to verify whether the application from Tenant A now appears under Azure Portal → Tenant B → Enterprise Applications.

If it’s listed there, that confirms the admin consent process completed successfully, and the “localhost refused to connect” message can safely be ignored as it was only due to the placeholder redirect URI.
Carolyne Milgo 1,151 Reputation points

2025-11-05T09:45:09.9933333+00:00

A redirect URI is where the Microsoft identity platform sends security tokens after authentication. Redirect URIs are configured in Platform configurations in the Microsoft Entra admin center. For Web and Single-page applications, you need to specify a redirect URI manually. For Mobile and desktop platforms, you select from generated redirect URIs.
Basically, the redirect URI is where you expect the user to land once they successfully complete authentication.
In the case of AzureAD B2C-use this documentation to guide you- https://learn.microsoft.com/en-us/azure/active-directory-b2c/tutorial-register-applications