Admin Approval Consent Types Clarificatoin

Question

Admin Approval Consent Types Clarificatoin

Gourav Jangra 25

We have created a APP and that APP permission we are using in web for login with azure devops details with OBO flow.
Sometime our customer get like

Consent1

some time customer is getting like
User's image

And we create another app on our Enterprise Tenant and we are getting like

Could someone help me understand when we will get those different consent

Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-12T06:04:42.9933333+00:00
Hey, it looks like you’re seeing two different admin‐consent experiences because of how your tenant and app are configured:

“Approval required” with a justification box • This UI appears when you’ve turned on the Admin consent request workflow in your tenant. End users who aren’t admins can fill in a justification and submit a request directly from the consent screen. Designated reviewers (global, cloud app, or application admins) then get notified and can approve or deny the request.

“Need admin approval” without any request button • This is the default block page when your tenant hasn’t enabled the admin consent workflow (or when user consent is fully disabled). In this case, non-admins simply see a message telling them to ask an administrator — there’s no built-in “request” flow.

A few other factors can toggle which screen you see:

If the permissions you’ve requested are admin-only (high-privilege or tenant-wide scopes), user consent is always blocked.

If your organization’s User consent settings disallow users from consenting to apps, they’ll get the static “Need admin approval” page.

If the app lives as an Enterprise application in your tenant and you’ve set User assignment required, only assigned users (and admins) can access it, so non-assigned users get the block page.

An unverified publisher tag can also prompt additional warnings — verifying your app’s publisher will remove the “risky/unverified” label.

To get the “request‐approval” flow with justification:

In the Azure portal go to Enterprise applications > Admin consent request (or Azure Active Directory > Enterprise applications > Admin consent request settings).

Enable the consent request workflow and add your reviewer accounts.

Make sure your User consent settings allow users to request admin consent (Users can request admin approval for apps).

Once that’s in place, users signing in will see the “Approval required” dialog, fill in their reason, and you can manage requests right in the portal.

References:

Configure the admin consent workflow – Microsoft Entra ID https://docs.microsoft.com/azure/active-directory/manage-apps/configure-admin-consent-workflow

Configure how end-users consent to applications using Microsoft Entra ID https://docs.microsoft.com/azure/active-directory/manage-apps/configure-user-consent?tabs=azure-portal#user-consent-settings

Admin consent on the Microsoft identity platform https://docs.microsoft.com/azure/active-directory/develop/v2-admin-consent

If the answer is helpful, kindly upvote it. If you have extra questions about this answer, please click "Comment".
Gourav Jangra 25 Reputation points

2026-06-12T07:19:12.7466667+00:00

Thanks @Shubham Sharma ,
My Azure admin have created a new APP in our Enterprise Account , when we use those clientid/secret I am getting below message. Could you please guide me on this aswell.

Sign in

Sorry, but we’re having trouble signing you in.

AADSTS700016: Application with identifier 'e694b87f-5dsf7-42a1-a50d-98b653619d12' was not found in the directory 'XXX'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.
Gourav Jangra 25 Reputation points

2026-06-12T07:19:22.74+00:00

Thanks @Shubham Sharma ,
My Azure admin have created a new APP in our Enterprise Account , when we use those clientid/secret I am getting below message. Could you please guide me on this aswell.

Sign in

Sorry, but we’re having trouble signing you in.

AADSTS700016: Application with identifier 'e694b87f-5dsf7-42a1-a50d-98b653619d12' was not found in the directory 'XXX'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.
Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-12T08:29:45.36+00:00

Gourav Jangra

Thank you for the reply.

We are checking and we will get back to you shortly.
Gourav Jangra 25 Reputation points

2026-06-12T10:51:09.3733333+00:00

Hello @Shubham Sharma please comment on it whenever you get any details on it
Gourav Jangra 25 Reputation points

2026-06-15T04:30:25.13+00:00

Hello @Shubham Sharma did you get the details for this request ?
Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-15T05:49:32.1466667+00:00
Gourav Jangra

Thank you for your reply.

The error occurs during the Azure AD connector initialization step in Entra Connect. Although the App Registration is created successfully, the wizard later fails during authentication with:

AADSTS700016: Application with identifier 'xxxx' was not found in the directory ''

The key detail is the blank directory value (''). This usually means the tenant context is not being resolved correctly during authentication.

Since the ConnectSyncProvisioning_XXXXXXXX application already exists with the same Client ID, the issue is likely happening when Entra Connect tries to initialize the connector or create the related service principal.

Please check the following:

Verify the corresponding Enterprise Application was also created in Entra ID.

Confirm the account used during setup belongs directly to the tenant and is not a guest account.

Verify the server can access:

login.microsoftonline.com

graph.microsoft.com

Ensure system time and DNS settings are correct on the server.

You can also review the logs here:

SQL

C:\ProgramData\AADConnect\trace-*.log

Check for entries related to tenant discovery, authority URL, service principal creation, or token acquisition failures.

The blank tenant value suggests the authentication request is failing before the tenant information is fully resolved during the final configuration stage.
Gourav Jangra 25 Reputation points

2026-06-15T10:39:06.84+00:00

Thanks @Shubham Sharma , we got the issue it was happening because of wrong client id , special char while sharing the details
Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-17T05:14:03.58+00:00

Gourav Jangra

Thanks for the confirmation. Let us know if you need any further assistance.

1 answer

Your answer

Gourav Jangra 25 Reputation points

2026-06-12T07:19:12.7466667+00:00

Thanks @Shubham Sharma ,
My Azure admin have created a new APP in our Enterprise Account , when we use those clientid/secret I am getting below message. Could you please guide me on this aswell.

Sign in

Sorry, but we’re having trouble signing you in.

AADSTS700016: Application with identifier 'e694b87f-5dsf7-42a1-a50d-98b653619d12' was not found in the directory 'XXX'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.
Gourav Jangra 25 Reputation points

2026-06-12T07:19:22.74+00:00

Thanks @Shubham Sharma ,
My Azure admin have created a new APP in our Enterprise Account , when we use those clientid/secret I am getting below message. Could you please guide me on this aswell.

Sign in

Sorry, but we’re having trouble signing you in.

AADSTS700016: Application with identifier 'e694b87f-5dsf7-42a1-a50d-98b653619d12' was not found in the directory 'XXX'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.
Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-12T08:29:45.36+00:00

Gourav Jangra

Thank you for the reply.

We are checking and we will get back to you shortly.
Gourav Jangra 25 Reputation points

2026-06-12T10:51:09.3733333+00:00

Hello @Shubham Sharma please comment on it whenever you get any details on it
Gourav Jangra 25 Reputation points

2026-06-15T04:30:25.13+00:00

Hello @Shubham Sharma did you get the details for this request ?
Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-15T05:49:32.1466667+00:00

Gourav Jangra

Thank you for your reply.

The error occurs during the Azure AD connector initialization step in Entra Connect. Although the App Registration is created successfully, the wizard later fails during authentication with:

AADSTS700016: Application with identifier 'xxxx' was not found in the directory ''

The key detail is the blank directory value (''). This usually means the tenant context is not being resolved correctly during authentication.

Since the ConnectSyncProvisioning_XXXXXXXX application already exists with the same Client ID, the issue is likely happening when Entra Connect tries to initialize the connector or create the related service principal.

Please check the following:

Verify the corresponding Enterprise Application was also created in Entra ID.

Confirm the account used during setup belongs directly to the tenant and is not a guest account.

Verify the server can access:

login.microsoftonline.com

graph.microsoft.com

Ensure system time and DNS settings are correct on the server.

You can also review the logs here:

SQL

C:\ProgramData\AADConnect\trace-*.log

Check for entries related to tenant discovery, authority URL, service principal creation, or token acquisition failures.

The blank tenant value suggests the authentication request is failing before the tenant information is fully resolved during the final configuration stage.
Gourav Jangra 25 Reputation points

2026-06-15T10:39:06.84+00:00

Thanks @Shubham Sharma , we got the issue it was happening because of wrong client id , special char while sharing the details
Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator

2026-06-17T05:14:03.58+00:00

Gourav Jangra

Thanks for the confirmation. Let us know if you need any further assistance.

Answer 1

These different consent prompts are controlled by Microsoft Entra ID consent types, permission types, and tenant consent policies.

Why some users see “Approval required” with a justification box
This screen appears when:
- The app is requesting permissions that require admin consent (for example, high‑privilege delegated or application permissions), and
- The tenant has enabled the Admin consent workflow or a similar policy that allows end users to request admin approval instead of blocking them.
In this case, the user can:
- Enter a justification (which is sent to admins), and
- Trigger an admin consent request.
  Admins then review and grant/deny the request in the Entra admin center.
Relevant behavior:
- Permissions that require admin consent are described in the permissions and consent overview.
- Admins can configure how users consent to apps and can enable workflows so users “request approval” instead of being hard‑blocked.
Why some users see “Need admin approval” with no justification box
This screen appears when:
- The app is requesting permissions that require admin consent, and
- The tenant’s user consent settings or app consent policies are stricter (for example, users cannot request admin approval, or the admin consent workflow is disabled/not available).
In this case, the user is simply told:
- “Ask an admin to grant permission to this app before you can use it.”
  There is no request form; an admin must:
- Sign in and grant tenant‑wide admin consent to the app, or
- Grant consent only for themselves, depending on how they access the consent screen.
Why behavior differs between customers and between your two apps
The prompt is determined by each customer tenant’s configuration, not by your code alone:
- User consent policy in the customer tenant decides whether:
  - Users can consent to low‑impact permissions only,
  - Users can consent to all non‑admin permissions, or
  - Users cannot consent at all and must use an admin workflow.
- Admin consent workflow configuration decides whether users see a justification box and can submit a request to admins.
- Permission set requested by your app (delegated vs application, low‑impact vs high‑privilege) determines whether admin consent is required at all.
Therefore:
- In tenants where admins allow user requests via the admin consent workflow, users see the “Approval required” + justification screen.
- In tenants where admins block user consent requests, users see “Need admin approval” and must contact an admin directly.
- In your own enterprise tenant, what you see depends on how your admins configured user consent and admin consent workflow, and on which permissions the new app requests.
How admins can control or standardize what users see
For each customer tenant, admins can:
- Configure how end users consent to applications and whether they can request admin approval.
- Classify permissions as low impact so users can consent to them directly if allowed.
- Use tenant‑wide admin consent for your app so that users in that tenant no longer see consent prompts for the same set of permissions.
For your app design:
- Keep the Configured permissions list minimal so fewer permissions require admin consent.
- For OBO scenarios, ensure the middle‑tier app has the required permissions and that an admin has granted consent for those permissions in each customer tenant.

References: