title: Can a service principal (Azure Application multi-tenant) grant admin consent to application in tenant using AZ CLI?
body: <h1>Context</h1>
  
  <p>We are using multiple directories (<strong>TENANT_A</strong>, <strong>TENANT_B</strong>) on Azure. The goal is to create a service principal (Application), <strong>_SP_APP</strong>, inside <strong>TENANT_A</strong> which is granted access into <strong>TENANT_B</strong>. We want to use this service principal in script to manage both directory easily.
  One of the script is to make new Application Registration inside <strong>TENANT_B</strong> AND to grant <em>ADMIN CONSENT</em> for these applications.</p>
  
  <h2>What is done</h2>
  
  <h3>_SP_APP</h3>
  
  <ul>
  <li>Global Admin on both Directory</li>
  <li>Granted Access to <strong>TENANT_B</strong> (Visible in Enterprise Application)</li>
  <li>Api Permissions were granted Admin Consent (<strong>TENANT_A</strong> and <strong>TENANT_B</strong>)
  
  <ul>
  <li>Microsoft Graph (Delegated and Application Full Access)</li>
  <li>Azure Active Directory Graph (Delegated and Application Full Access)</li>
  </ul></li>
  </ul>
  
  <h1>Steps</h1>
  
  <h2>Working correctly</h2>
  
  <pre><code># Login with service principal of multiple tenants application
  az login --service-principal -u _SP_APP -p &lt;PASSWORD&gt; --tenant TENANT_B
  # Creating application and fetching ID
  _OBJECT_ID=`az ad app create ...` 
  </code></pre>
  
  <h2>Not Working</h2>
  
  <pre><code># Granting Admin Consent
  az ad app permission admin-consent --id $_OBJECT_ID
  # ERROR
  Bad Request({"ClassName":"Microsoft.Portal.Framework.Exceptions.ClientException","Message":"AADSTS50058: A silent sign-in request was sent but no user is signed in.\r\nTrace ID: 9c9bd004-a97a-4543-8ff0-e314de77a700\r\nCorrelation ID: 44c79409-2f3e-43de-a84b-1e5a42e382e7\r\nTimestamp: 2019-10-28 15:54:20Z" ...
  </code></pre>
  
  <p>What is strange is that when we <code>az login</code> with a Global Admin User and execute the script, it works fine.</p>
  
  <h1>Question</h1>
  
  <p>Did we miss something to allow this service principal to be able to grant admin-consent or is it something only "user" can do? (I did not find any response in microsoft azure documentation).</p>
  
  <p>Thank you</p>