Microsoft Entra ID
Microsoft identity platformConsent Types Developer
In brief
The guidance now explicitly states that the App registrations and Enterprise applications portal experiences do not know about dynamic consent permissions at consent time.
What Entra admins need to know
Administrators can more clearly understand the limitation when reviewing permissions that require admin consent.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Allowing an application to request permissions dynamically through the scope parameter gives developers full control over your user's experience. You front load your consent experience and ask for all permissions in one initial authorization request. If your application requires a large number of permissions, you can gather those permissions from the user incrementally as they try to use certain features of the application over time.
@@ -36,7 +36,7 @@ If the user hasn't consented to any of the scopes in the request, they get a pro Allowing an application to request permissions dynamically through the `scope` parameter gives developers full control over your user's experience. You front load your consent experience and ask for all permissions in one initial authorization request. If your application requires a large number of permissions, you can gather those permissions from the user incrementally as they try to use certain features of the application over time. > [!IMPORTANT]-> Dynamic consent can be convenient, but presents a significant challenge for permissions that require admin consent. The admin consent experience in the **App registrations** and **Enterprise applications** blades in the portal doesn't know about those dynamic permissions at consent time. We recommend that a developer list all the admin privileged permissions that the application needs in the portal. +> Dynamic consent can be convenient, but presents a significant challenge for permissions that require admin consent. The admin consent experience in the **App registrations** and **Enterprise applications** blades in the portal doesn't know about those dynamic consent permissions at consent time. We recommend that a developer list all the admin privileged permissions that the application needs in the portal. > > This enables tenant admins to consent on behalf of all their users in the portal once. Users don't need to go through the consent experience for those permissions on sign in. The alternative is to use dynamic consent for those permissions. To grant admin consent, an individual admin signs in to the app, triggers a consent prompt for the appropriate permissions, and selects **consent for my entire org** in the consent dialogue.