Admin consent is required for the permissions requested by this application.

Error code AADSTS90094 indicates that the application is requesting permissions that only an administrator can grant. The user is a member user and can’t complete consent by themselves.

To resolve this, a tenant administrator must grant admin consent for the application and its requested permissions.

Steps for the tenant administrator:

1. Verify user consent settings
   1. Sign in to the Azure portal as a Global Administrator, Company Administrator, or Application Administrator.
   2. Go to Microsoft Entra ID → Enterprise applications → Consent and permissions.
   3. Under User consent for applications, check whether user consent is disabled:
      • If Do not allow user consent is selected, non-admin users will always see “Need admin approval” / AADSTS90094. In this case, admin consent is required.
2. Locate the application
   1. In Microsoft Entra ID → Enterprise applications.
   2. Ensure the correct tenant is selected.
   3. Set Application type to All applications and search using the App ID shown in the sign-in logs.
   4. If the app is not found, the admin must perform admin consent using the app’s consent URL (see step 4).
3. Grant admin consent via Enterprise applications
   1. In Enterprise applications, open the application.
   2. Go to Permissions (or Security → Permissions depending on portal view).
   3. Select Grant admin consent for <Organization>.
   4. Review the requested permissions and confirm.
   5. After this, users should be able to sign in without seeing AADSTS90094, unless new higher-privilege permissions are later added.
4. Grant admin consent via consent URL (if needed)
   • If the admin does not see a consent screen when accessing the app, construct or use the app’s admin consent URL:
     • https://login.microsoftonline.com/<Tenant-ID>/adminconsent?client_id=<App-ID>
   • Or force a consent prompt by adding &prompt=consent to the authorization request URL.
   • The permissions being requested must already be configured on the app registration’s API permissions.
5. Confirm permissions and scopes
   • Ensure the app has at least a basic sign-in permission such as User.Read or OpenID configured under API permissions and that these have been consented.
   • If the app requests Microsoft Graph, OneDrive, or other admin-restricted scopes, those must be approved by an admin as above.
6. If users are still blocked after admin consent
   • Check if Assignment required is enabled for the app:
     1. In Enterprise applications, open the app → Properties.
     2. If Assignment required = Yes, only assigned users/groups can access the app even after admin consent. Assign the user or a group containing the user to the app, or disable Assignment required.

Once an administrator has granted tenant-wide admin consent for the app and any required user assignment is in place, the user sign-in should succeed and error 90094 should no longer appear.

References:

• Troubleshoot consent issues in Microsoft Entra ID
• Unexpected error when performing consent to an application
• Request permissions that require administrative consent
• Consent experience for applications in Microsoft Entra ID
• Problems signing in to a Microsoft application
• Corporate account apps registration error: AADSTS90094 - Microsoft Q&A