title: admin_consent for openid connect and dynamic scopes
body: <p>We have a webapplication that uses openid connect, with azure as the identityprovider, to sign in users. So users, when signing in is sent to a URL like:</p>
  
  <pre><code>https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?response_type=id_token+token&amp;client_id=3{clientId}&amp;response_mode=form_post&amp;redirect_uri=http://localhost:8765/ms/oidc/signon/response&amp;scope=openid+profile+https://graph.microsoft.com/user.read&amp;state=1234&amp;nonce={nonce}
  </code></pre>
  
  <p>this works fine, but requires users to consent to our apps permission scopes the first time they use it. </p>
  
  <p>We'd like to offer office365 administrators the ability to consent on behalf of their entire tenant, so we send them to an endpoint like:</p>
  
  <pre><code>https://login.microsoftonline.com/common/adminconsent?client_id={clientId}&amp;state=12345&amp;redirect_uri=http://localhost:8765
  </code></pre>
  
  <p>this also seems to work fine, and the admin i informed that they will consent on behalf of all users in their tenant. However, the user is still presented with the consent prompt on first login. 
  This does make sense, since the app is only registered with the user.read permission, so if we instead sent the user to </p>
  
  <pre><code>https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?response_type=token&amp;client_id={clientId}&amp;response_mode=form_post&amp;redirect_uri=http://localhost:8765/ms/oidc/signon/response&amp;scope=https://graph.microsoft.com/user.read&amp;state={state}&amp;nonce={nonce}
  </code></pre>
  
  <p>without the dynamic permission request, and response type only set to token, the admin consent works, and users are not presented with the consent prompt. 
  So, I guess I have 2 questions:</p>
  
  <p>1) is this how it's supposed to work, or is there some way to grant admin consent to the profile and openid scopes?</p>
  
  <p>2) Am I actually missing anything by not requesting these(openid+profile) permissions? I don't receive and id_token in the response, but is seems the authentication_token already contains even more information than the id_token does anyway</p>