4 ways to fix error AADSTS65001 (The user or administrator has not consented to use the application)

---------------example-12------------------" rel="nofollow ugc">https://docs.microsoft.com/en-us/powershell/module/sharepoint-pnp/connect-pnponline?view=sharepoint-ps#------------------example-12------------------ approved: true type: comment parent: '27700' userId: '1'

• id: '27702' author: p whelan email: [email protected] url: '' ip: 54.246.135.213 date: '2020-09-11 10:10:17' content: |- Connect-PnPOnline -Url $SiteURL -Credentials Get-Credential

  I get the rather perplexing ...

  "Connect-PnPOnline : No credential store entry named 'Get-Credential' exists"

  Thanks for the help! approved: true type: comment parent: '27701' userId: '0'

• id: '27703' author: Antti K. Koskela email: [email protected] url: https://www.koskila.net/antti-koskela/ ip: 35.157.171.156 date: '2020-09-11 12:44:09' content: >- Try it like this:

  Connect-PnPOnline -Url https://contoso.sharepoint.com -PnPManagementShell

  Or like this:

  Connect-PnPOnline -Url https://contoso.sharepoint.com -PnPManagementShell -Credentials (Get-Credential)

  Just out of interest - is this a fairly new tenant, created in the last month or so? approved: true type: comment parent: '27702' userId: '1'

• id: '27721' author: Henry email: [email protected] url: '' ip: 35.180.71.154 date: '2020-09-20 12:54:41' content: >- Hi Antti, am having the same problem when trying to create a team(class team) via graph api. When i create a calendar, read emails and normal team via graph api which requires Delegated permissions type, it works but when creating a "class" team which requires Application permission type gives the above error. I have registered the app in azure and granted the required delegated and Application permissions as required by the MS documentation. approved: true type: comment parent: '0' userId: '0'

• id: '27722' author: Henry email: [email protected] url: '' ip: 35.181.60.104 date: '2020-09-20 12:57:11' content: Sorry, am using asp.net core to interact with the graph api. approved: true type: comment parent: '0' userId: '0'

• id: '27724' author: Antti K. Koskela email: [email protected] url: '' ip: 3.120.128.195 date: '2020-09-21 15:10:40' content: >- Hi Henry,

  Has a global administrator consented to the app? Application permissions on Graph API seem to require global administrator instead of cloud app administrator. Is AADSTS65001 the error code you're getting? approved: true type: comment parent: '27722' userId: '1'

• id: '27923' author: Brendan Horner email: [email protected] url: http://www.hornerit.com ip: 3.221.159.61 date: '2021-04-21 20:12:27' content: >- One key addition to the information would be a scenario I just ran into: Azure Automation has "RunAs" accounts that will generate an app registration that you can use like any other app for Runbooks. If you wish to use this app registration with delegated permissions, you must TEMPORARILY add a redirect URI to that app registration so that the interactive consent can complete. Once you complete the consent, you can remove the URI. approved: true type: comment parent: '0' userId: '0'

• id: '27986' author: Somesh email: [email protected] url: '' ip: 13.126.44.242 date: '2021-06-08 11:51:03' content: >- SharePoint Online Management Shell and PnP.Pwershell can not go together. If want to execute PnP.PowerShell then must need to uninstall SharePoint Online Management Shell and restart the PC.

  My issue is solved just by uninstalling SharePoint Online Management Shell.

  PnP.PowerShell 1.6.0

  SharePointPnPPowerShellOnline 3.29.2101.0 approved: true type: comment parent: '0' userId: '0'

• id: '27992' author: Antti K. Koskela email: [email protected] url: '' ip: 18.159.34.247 date: '2021-06-15 12:51:16' content: >- Thanks for your comment, Brendan! That's an interesting edge case you've run into... 😅 approved: true type: comment parent: '27923' userId: '1'

• id: '27993' author: Antti K. Koskela email: [email protected] url: '' ip: 3.66.227.105 date: '2021-06-15 12:56:17' content: >- Thanks for your comment, Somesh! I haven't run into this before, but then again, I haven't actually used SharePoint Online Management Shell for a while...

  What was the error you ran into, if I may ask? :) approved: true type: comment parent: '27986' userId: '1'

• id: '28026' author: el_topo email: [email protected] url: '' ip: 18.185.130.81 date: '2021-07-07 18:27:08' content: >- It is possible to have them both installed and running at the same time.

  Just install PowerShell Core next to Windows PowerShell. This way you may have SharePointPnPPowerShellOnline installed on first one PowerShell and PnP.PowerShell on other one. I've been using them both on my machine for some time now without any issues. approved: true type: comment parent: '27986' userId: '0'

• id: '28161' author: Vivek Talokar email: [email protected] url: '' ip: 10.1.47.120 date: '2021-10-22 13:44:48' content: >- Hi Antti k,

  Accessing the token by login global administrator role getting the issue The user or administrator has not consented to use the application with ID  approved: true type: comment parent: '27993' userId: '0'

• id: '28227' author: Antti K. Koskela email: [email protected] url: '' ip: 10.1.47.120 date: '2021-12-17 23:22:46' content: |- Hi Vivek & thanks for your comment!

  What are you trying to do when you get that error? approved: true type: comment parent: '28161' userId: '1'

• id: '28415' author: Mujahid email: [email protected] url: '' ip: 10.1.6.61 date: '2022-08-05 20:19:13' content: >- aadsts500011 the resource principal named was not found in the tenant named. This can be happen if the application has not been installed by the administrator of the tenant or consented. I am getting same error while using flutter api although It's work fine in Postman. Is there anything else we required to mobile app? approved: true type: comment parent: '0' userId: '0'

• id: '28549' author: Ronak somahina email: [email protected] url: '' ip: 10.1.48.224 date: '2022-12-21 11:47:04' content: I want to know more about it approved: true type: comment parent: '0' userId: '0'

• id: '28550' author: Ronak somahina email: [email protected] url: '' ip: 10.1.48.224 date: '2022-12-21 12:07:01' content: "I mean how we get token from azure ad with C# code for based on user id and password. no browser involve . i just pass my user id password to api call generateazureadtoken. \r\n\r\nand it return me token from azure ad." approved: true type: comment parent: '0' userId: '0'

• id: '28575' author: Antti K. Koskela email: [email protected] url: '' ip: 10.1.79.80 date: '2023-03-09 10:15:19' content: "Hi Ronak and thanks for your comment!\r\n\r\nFor non-interactive sign-in, the preferred way would be one of the following:\r\n

  1. Using Managed Identity
  2. Using a Client Id + a certificate
  3. Using a Client Id + Client Secret
  \r\nLogging in unattended using a user account (user id and password) is prone to issues and not very secure. There's more on unattended logging in for example <a href="https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app?WT.mc_id=AZ-MVP-5003535" target="_blank" rel="noopener nofollow ugc">here.\r\n\r\nThe last time I developed a daemon and I just wanted to get it up and running quickly, I used ClientCredentials - <a href="https://learn.microsoft.com/en-gb/dotnet/api/azure.identity.clientsecretcredential?WT.mc_id=AZ-MVP-5003535&view=azure-dotnet" target="_blank" rel="noopener nofollow ugc">here is more on that.\r\n\r\nAnd here's a sample I have published on how to use DefaultAzureCredential - if that matches your use case - to use whatever authentication method your app is configured to use (in my case I enabled Azure CLI to use locally and Managed Identity that'll work in the cloud):\r\nh<a href="http://ttps://www.koskila.net/how-to-update-from-deprecated-microsoft-azure-services-appauthentication-to-new-and-shiny-azure-security-keyvaults-secrets/" target="_blank" rel="noopener nofollow ugc">ttps://www.koskila.net/how-to-update-from-deprecated-microsoft-azure-services-appauthentication-to-new-and-shiny-azure-security-keyvaults-secrets/\r\n\r\nHope that helps!" approved: true type: comment parent: '28550' userId: '1'

• id: '28576' author: Antti K. Koskela email: [email protected] url: '' ip: 10.1.39.28 date: '2023-03-09 10:19:05' content: >- This is a good point - and to make sure nothing gets polluted, you can always configure another user account to run another PowerShell instance. And I guess Windows Terminal makes it even more obvious and transparent, since you can easily see all different PowerShell (and other terminal client) variants you have available: approved: true type: comment parent: '28026' userId: '1'

• id: '28577' author: Antti K. Koskela email: [email protected] url: '' ip: 10.1.39.28 date: '2023-03-09 10:46:46' content: "AADSTS500011 on the authentication request is usually caused by you actually calling the wrong tenant, as funny as it sounds 😅 So depending on your app registration and auth configuration, double-check the tenant id and that your application is really parsing the settings properly - if the request for example goes to the common endpoint for an enterprise application or a tenant-scoped app request, the app identity can't be resolved.\r\n\r\nI know it's been a while, so I hope you figured it out!" approved: true type: comment parent: '28415' userId: '1'

Have you run into an AADSTS65001 error with your application, that tries to authenticate against Azure AD? I sure have - seems to happen at least every other time when I'm building something that uses AAD to authenticate against SharePoint.

Fixing issues with Azure AD authentication for Enterprise applications can be tricky. But a lot of the time, this is just another Azure Active Directory error that we can fix easily. This article contains multiple solutions for this issue, where granting admin consent has somehow failed.

Not all of the different solutions will work for all situations, though! That's why I included a couple of different options to try. Changes are, one of them works for you!

Note: If you came here looking for a solution to an error with code AADSTS50196, check out this post instead: How to fix error AADSTS50196 on Microsoft web properties?

Background

So, what's the reason for running into issues with Admin Consent (like when you get the dreaded AADSTS65001 error)?

Imagine this:
You're trying to add or use an app, but it requires such permissions from your tenant, that only an administrator can grant. Typically to add this kind of an app, you'll have to be a global administrator.

This is when admin consent is required for the usage of the app - and if that hasn't been granted, you'll get errors about administrators not having consented to the use of the app you're accessing. This way, you also can't add the app yourself.

Additionally, just to make the investigation just a bit more complicated, if it's an enterprise application, it could also be in an invalid state after someone tried adding the app without sufficient permissions. This could stop you from adding the app, even if you do have sufficient permissions!

Fun, right? But no worries, as there's always a workaround or two available!

I've been investigating a lot of these issues in relation to organizations using a mobile app, which the customer has been deploying as an enterprise application. Most of the things should apply for web-based apps or console programs or whatever else you're deploying, too - especially if they're enterprise applications in Azure AD!

The whole error might look something like this:

Failed to authenticate #1: 
Error: Request authority:https://login.windows.net/common resource:https://tenant.sharepoint.com clientid:[appId]  ErrorCode:invalid_grant ErrorDescription:AADSTS65001: The user or administrator has not consented to use the application with [appid]. 
Send an interactive authorization request for this user and resource.

Trace ID: 5b92cb30-6321-4e2a-99e3-b4b2b6a46c94
Correlation ID: fc8a84ec-1578-4290-b49b-42322b791a3a
Timestamp: 2020-11-17 11:49:30Z

Or you get something like this:

{  
 "error":"invalid_grant",  
 "error_description":"AADSTS65001: The user or administrator has not consented to use the application with ID [appId]"
}

How to fix these issues?

Solutions

Okay, there are a bunch of solutions, which I'm going to outline here. I'll be starting from the easy ones and progressing into the more difficult and exotic ones.

*Please note: if you have an issue, where only admin users are able to log in (without any dialogs or warnings about granting permissions), and everyone else gets an error, please jump directly to solution 2.

Time needed: 20 minutes.

How to fix error AADSTS65001?

1. Get help from an admin

   First of all, maybe it's true. Simple, but worth trying first. Maybe an admin really hasn't consented to the permissions. Just get someone with global administrator permissions to try the app, and see what happens.

   If it doesn't work for him/her either, check out the next solution.

2. Make sure that your Azure AD settings allow adding such apps

   There are a couple of properties under Azure AD Application > Manage > User settings that affect how the app is registered. Someone in your organization may have turned app registration off altogether, or limited the options severely.

   The latest Portal version has split the settings into 2 different areas. You'll have the settings concerning app registrations "local" to just this directory under Directory > Manage > User settings. The settings only affecting Enterprise Applications are accessible by either clicking a link on the aforementioned page or by navigating to Directory > Enterprise applications > User settings.

   See the 2 screenshots below - first, you can edit the "user settings" from the AAD:

   

   
   "User Settings" view for your Azure Active Directory instance in general. Accessible via Directory > Manage > User settings.

   And when you select to access the end-user settings from there, you'll be able to change the settings for Enterprise Applications in particular:
   
   The "User Settings" view for your Azure Active Directory instance's Enterprise Applications. It's accessible through Directory > Enterprise applications > User settings.

   Note: If you absolutely need to have the ability to register apps turned off (for example, to comply with GDPR or similar regulations), I have another article in the works on possible workarounds of Azure AD app registration.

   Ping me or send me a nudge via the comments section or through https://www.koskila.net/contact/ to remind me to finish that article!

3. Remove the app, and be sure to ask a global admin to log in once

   If the settings above were okay, check this tip out.

   This solution itself only applies to Enterprise Applications, since the method for registering a "normal app" is different from enterprise ones. Enterprise apps are registered to your Azure AD instance automatically based on their application ID. It should, more or less, just provision a service principal based on the app id, which in turn is specified in the manifest that stays wherever the enterprise app was originally registered in. From a user's point of view, this should happen automatically. It always doesn't.

   Typically, someone might try to add an enterprise application without having permission to do so. Apparently, this causes your Azure AD instance to get quite confused, and the app won't work. Not for admins (who could grant the consent), but also especially not for you.

   That means, that this particular instance of the app will not work. Ever.
   You can fix this quite easily, though. The global administrator just needs to browse to Azure AD (remember to choose the right one, though), remove the app (see screenshot below), and then log in to the app. With some apps it's pivotal, that the first person to log in is a global administrator, to make it possible for them to give admin permission in the first place (duh).

   

   
   Azure AD - how to remove an enterprise application (registration) from your AAD instance

4. Craft a specific log in & admin consent URL for a global admin to test

   If you don't have admin permissions, and maybe none of the global administrators can use any apps or something, maybe you could try this next. You can just send them a URL they can use to grant admin consent to an enterprise application.

   Easy? Maybe. Are they going to click a suspicious link like this without questioning it even for a second? In my experience, yes. But also, be prepared to explain what you're trying to do :)
   https://login.microsoftonline.com/**[tenant_name_in_onmicrosoft.com-form]**/oauth2/authorize?client_id=**[appId]**&response_type=code&redirect_uri=http://&nonce=1234&resource=https://graph.windows.net&prompt=admin_consent

   This URL should prompt the user (who should have global admin permissions), to grant admin consent for the app.

5. Are you using Connect-PnPOnline when getting this error?

   This is a pretty new one! Instead of doing whatever you're doing to connect, try this:

   Connect-PnPOnline -PnPManagementShell -Url

   Worked for me!

If that didn't help, you could also try enabling Legacy Auth Protocols (ask your admin for permission first!) - this article will tell you how:

https://www.koskila.net/how-to-fix-the-web-site-does-not-support-sharepoint-online-credentials-the-response-status-code-is-unauthorized-error/#Solution

Got this tip from these 2 GitHub issues - will update when there's more information!:

• https://github.com/pnp/PnP-Sites-Core/issues/2732
• https://github.com/pnp/sp-starter-kit/issues/436

Did none of these solutions work?

I've been resolving a lot of different authentication issues with Azure AD lately. Maybe something new has come up after writing this article - let me know in the comments!