A cloud-based identity and access management service for securing user authentication and resource access
Insufficient privileges for App registrations usually mean that app creation is restricted in the tenant and the account doesn’t have one of the required roles.
Role verification and changes can only be done by a Microsoft Entra administrator; they aren’t visible or changeable from the user side. The following is what the administrator needs to check and do:
- Confirm current roles for the account
In the Microsoft Entra admin center, an admin should:- Go to Entra ID → Users → [your user] → Assigned roles.
- Verify whether the account has one of these roles:
- Application Developer (for permission to register apps when app creation is restricted).
- Application Administrator (privileged role; can create and manage app registrations and enterprise applications, and consent to most app permissions).
- Cloud Application Administrator (similar to Application Administrator but without app proxy management; can create and manage app registrations and enterprise applications, and consent to most app permissions).
- If the account has no suitable role
The admin should choose one of these options:- Grant app registration permissions by assigning the Application Developer role when the goal is only to allow app registration and consent for own apps.
- Assign Application Administrator or Cloud Application Administrator if broader app management responsibilities are required.
- Alternatively, the admin can create the app registration themselves and then assign the account as an application owner, which allows management of that specific app without changing directory-wide roles.
- Why this is required
When app registration is restricted, users without one of these roles see messages like:- “Access denied”
- “You do not have access”
- “You don't have permission to register applications in the directory. To request access, contact your administrator.”
The resolution is always an admin action: either role assignment or admin-created registration.
Contact the Microsoft Entra or Microsoft 365 administrator in the organization and ask them specifically to:
- Check whether the account has Application Developer, Application Administrator, or Cloud Application Administrator.
- If not, either assign one of these roles or create the required app registration and add the account as an owner.
References: