/errors/entra-id/aadsts65001-user-or-administrator-has-not-consented
AADSTS65001: The user or administrator has not consented to use the application
- tool
- Microsoft Entra ID
- versions
- Microsoft Entra ID
- os
- any
AADSTS65001: The user or administrator has not consented to use the application with ID '...' named '...'. Send an interactive authorization request for this user and resource. means the app asked for a token with permissions nobody has approved in this tenant. Microsoft's reference names it DelegationDoesNotExist. The token request was non-interactive, so Entra ID could not show a consent screen. Fix it by granting admin consent for the app, or by sending the user through one interactive sign-in where they can consent.
Grant admin consent
In the Microsoft Entra admin center, as at least a Cloud Application Administrator (consent to Microsoft Graph application permissions needs Privileged Role Administrator):
- Enterprise applications > select the app > Permissions.
- Grant admin consent for TENANT, review the permissions, accept.
The same is possible from the app registration (API permissions > Grant admin consent). For a multitenant app used by other organizations, an admin of each tenant opens the admin consent URL:
https://login.microsoftonline.com/TENANT_ID/adminconsent?client_id=APP_IDReplace TENANT_ID with the customer tenant and APP_ID with the Application (client) ID.
Why it appears without a prompt
| Flow | Can show a consent prompt? |
|---|---|
| Authorization code (browser sign-in) | Yes, if user consent is allowed |
| Refresh token, silent token acquisition | No: returns AADSTS65001 |
| On-behalf-of (API calling another API) | No: the downstream scopes need consent in advance |
| Resource owner password credentials (ROPC) | No |
| Client credentials (app-only) | Uses application permissions; these always need admin consent |
A common case is an app that works for the developer (who consented once) and fails for everyone else, or one that fails right after a new scope was added to the code: the existing consent does not cover the new scope.
Check what has been consented
From Microsoft Graph PowerShell (Connect-MgGraph -Scopes "Application.Read.All"):
$sp = Get-MgServicePrincipal -Filter "appId eq 'APP_ID'"
Get-MgOauth2PermissionGrant -Filter "clientId eq '$($sp.Id)'" | Select-Object ConsentType, PrincipalId, ScopeConsentType AllPrincipals is admin consent for everyone; Principal is a single user's consent. The scopes in Scope must include every delegated permission the app requests.
Related: AADSTS error codes, Graph permission vs Entra role.