# \[Question\] Microsoft OpenID Admin Consent

**URL:** <https://forum.inductiveautomation.com/t/question-microsoft-openid-admin-consent/22041>\
**Category:** Ignition Early Access\
**Created:** [January 22, 2019, 3:30pm UTC](https://forum.inductiveautomation.com/t/question-microsoft-openid-admin-consent/22041 "2019-01-22T15:30:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ryanjmclaughlin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryanjmclaughlin/32/4318_2.png) [@ryanjmclaughlin](https://forum.inductiveautomation.com/u/ryanjmclaughlin)\
**Post date:** [January 22, 2019, 3:30pm UTC](https://forum.inductiveautomation.com/t/question-microsoft-openid-admin-consent/22041/1 "2019-01-22T15:30:49Z")

</div>

I am working on setting up an OpenID provider. I was having some issues before so I deleted the provider and re-created with the 1/18 build.

When testing the login I am getting a message from Microsoft that the App needs admin consent… what is Ignition attempting to request here? In an earlier build this did not come up.

```auto
Need admin approval

Ignition needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.

```

```auto
Message: AADSTS900941: An administrator has set a policy that prevents you from granting Ignition the permissions it is requesting. Contact an administrator who can grant permissions to this application on your behalf.

```

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [January 22, 2019, 4:35pm UTC](https://forum.inductiveautomation.com/t/question-microsoft-openid-admin-consent/22041/2 "2019-01-22T16:35:10Z")

</div>

Hi @ryanjmclaughlin -

Ignition requests the `openid` scope in addition to any scopes you specify in your IdP config. Like the message says - you may need to adjust your policies on your IdP.

You are using Azure AD right? You may need to click the button below:

 ![03%20AM](https://us1.discourse-cdn.com/inductiveautomation/original/2X/2/2ad6d915164a4a829cb16b143cfff28404ed1bb0.png)

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [January 22, 2019, 4:45pm UTC](https://forum.inductiveautomation.com/t/question-microsoft-openid-admin-consent/22041/3 "2019-01-22T16:45:18Z")

</div>

I found this API permissions best practices document for Azure AD which may help: [https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-permissions-and-consent](https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-permissions-and-consent)

---

<div class="post-metadata">

**Author:** ![ryanjmclaughlin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryanjmclaughlin/32/4318_2.png) [@ryanjmclaughlin](https://forum.inductiveautomation.com/u/ryanjmclaughlin)\
**Post date:** [January 22, 2019, 7:06pm UTC](https://forum.inductiveautomation.com/t/question-microsoft-openid-admin-consent/22041/4 "2019-01-22T19:06:29Z")

</div>

Thanks, was able to get one of our admins to enable that.