'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Microsoft Defender for Cloud Apps API Token Admin Approval Error
Question details
The user's Python application fails to obtain an MSAL access token for the Microsoft Defender for Cloud Apps API due to an administrator approval requirement.
- Product
- Microsoft Defender for Cloud Apps, Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Authenticating a Python application using MSAL to access the Defender for Cloud Apps API.
- Observed behavior
- The sign-in response returns an error stating that administrator approval is required, even though the necessary API permissions were added to the app registration.
Ensure you have Global Administrator or Privileged Role Administrator rights in your Microsoft Entra ID (formerly Azure AD) tenant to grant the necessary consent.
Grant Tenant-Wide Admin Consent in Microsoft Entra ID
Resolve the admin approval error by having a tenant administrator grant tenant-wide consent for the requested API permissions.
Many high-privilege APIs, including Microsoft Defender for Cloud Apps, require administrative consent before an application can request access tokens. This prevents unauthorized applications from accessing sensitive organizational data.
Log in to the Microsoft Entra admin center (or Azure portal) using an account with administrator credentials.
Go to 'Identity', then select 'Applications', and click on 'App registrations'. Find and select your registered Python application.
Click on 'API permissions' from the left-hand menu to view the currently configured permissions for your application.
Click the 'Grant admin consent for [Your Tenant Name]' button located above the permissions list, and confirm the action when prompted.
Verify MSAL Application Credentials and Scopes
Ensure that your Python MSAL configuration matches the consented permissions and uses the correct OAuth scopes.
Boost Your Productivity with WPS Office
While configuring API permissions and managing tenant consent in Microsoft Entra ID requires specific admin tools, your daily documentation doesn't have to be complicated. WPS Office provides a lightweight, comprehensive suite for all your document, spreadsheet, and presentation needs without the complex configurations.
Frequently Asked Questions
Why does my MSAL Python app require admin approval?
In Microsoft Entra ID, certain high-privilege APIs, including Microsoft Defender for Cloud Apps, require an administrator to review and consent to the permissions before the application can request tokens on behalf of users or the tenant.
Who can grant admin consent in Microsoft Entra ID?
Only users with specific administrative roles, such as Global Administrator, Privileged Role Administrator, or Cloud Application Administrator, have the authority to grant tenant-wide admin consent for application permissions.
What should I do if the 'Grant admin consent' button is grayed out?
If the button is grayed out, it typically means your current account lacks the necessary administrative permissions in the Entra ID tenant. Contact your organization's IT admin to grant consent on your behalf.
Where can I find further support for Microsoft Defender for Cloud Apps API issues?
For specialized developer and API integration issues, it is recommended to consult the Microsoft Defender for Cloud Apps Q&A community or the MSAL for Python GitHub issue tracker for expert assistance.
