title: Azure AD admin consent required when it shouldn't
body: <p>I have 2 tenants: </p>
  
  <ul>
  <li>One for my organization, where I manage users (A)</li>
  <li>One that I manage the applications and permissions (B)</li>
  </ul>
  
  <p>My webapp is on tenant A and I configured authentication on the portal using Azure AD on tenant B.</p>
  
  <p>On tenant B I registered the application with only one permission which does not require admin consent: <em>Windows Azure Active Directory > Sign in and read user profile</em>. </p>
  
  <p><a href="https://i.stack.imgur.com/z7gyH.png" rel="noreferrer"><img src="https://i.stack.imgur.com/z7gyH.png" alt="enter image description here"></a></p>
  
  <p>When the user logs in he gets the following error: </p>
  
  <blockquote>
    <p>AADSTS90093: This operation can only be performed by an administrator. Sign out and sign in as an administrator or contact one of your organization's administrators.</p>
  </blockquote>
  
  <p>I believe that this error should not be raised, since the only permission required by the application doesn't required admin. </p>
  
  <p><strong>EDIT</strong></p>
  
  <p>This is the URL that I am redirected to when I try to access the application when I'm not logged in</p>
  
  <pre><code>https://login.microsoftonline.com/d6ac45af-3289-4f79-a826-27824e1c467d/oauth2/authorize?response_type=code+id_token&amp;redirect_uri=https%3A%2F%2Ftechnipfmc-tools-app-test.azurewebsites.net%2F.auth%2Flogin%2Faad%2Fcallback&amp;client_id=d340f0ed-5eb3-43e8-9a50-c449649f3ee1&amp;scope=openid+profile+email&amp;response_mode=form_post&amp;nonce=1895ec0ffef64447bbb712bdae61c7fb_20170521070654&amp;state=redir%3D%252F
  </code></pre>
  
  <p><strong>EDIT 2</strong></p>
  
  <p>I found out a solution <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-integrating-applications" rel="noreferrer">here</a>:</p>
  
  <blockquote>
    <p>As an administrator, you can also consent to an application's delegated permissions on behalf of all the users in your tenant. This will prevent the consent dialog from appearing for every user in the tenant. You can do this from the Azure portal from your application page. From the Settings blade for your application, click Required Permissions and click on the Grant Permissions button.</p>
  </blockquote>
  
  <p>I don't know why had to do that since I'm only using permissions that don't require admin consent.</p>