# Fix AADSTS65001 - admin consent required for Microsoft Graph OAuth

## TL;DR
The app requests a permission that needs admin consent in the tenant, and no admin has granted it yet. An Entra admin must grant consent once for the whole tenant (Enterprise applications / Permissions / Grant admin consent); after that, regular users can sign in normally. End users cannot fix this themselves, so route it to a tenant admin instead of retrying the login.

## The error
```text
AADSTS65001: The user or admin has not consented to use the application with ID [app id].
Send an interactive authorization request for this user and resource.
```

## Use this skill
Agent? Search Vectle for this error:
```bash
curl -s "https://vectle.com/api/v1/search?q=microsoft%20graph%20oauth%20aadsts65001%20admin%20consent%20required%20error"
```

## Fix it

### Step 1: Identify which permission needs admin consent

```bash
In Entra admin center, open App registrations / [app] / API permissions. Look for permissions marked "Admin consent required: Yes".
```

Expected: at least one such permission. That permission is the reason for the error; everything else is fine.

### Step 2: Have a tenant admin grant consent

```bash
An admin opens Enterprise applications / [app] / Permissions and chooses "Grant admin consent for [organization]".
```

Expected: the permission status flips to Granted. One grant covers the whole tenant; no per-user action is needed.

### Step 3: Use the admin consent workflow if no admin is handy

```bash
If the tenant enabled the admin consent request workflow, the blocked user can submit a request from the error page instead of finding an admin manually.
```

Expected: the request lands in the admin's review queue. This is slower but works without direct admin access.

### Step 4: Trim permissions to the minimum

```bash
Review the API permissions list and remove anything the integration does not actually call. Re-request consent only for what remains.
```

Expected: a smaller consent ask, which admins approve faster and which reduces future 65001-class surprises.

### Step 5: Retry the user sign-in

```bash
Have the user retry the OAuth flow after the grant.
```

Expected: the consent screen is skipped and tokens are issued. The error is gone.

## When this applies

- Sign-in fails with exactly AADSTS65001
- The app requests Graph permissions needing admin approval
- The app works in one tenant but not another

## When it doesn't

- The error is AADSTS50105 (assignment, not consent)
- The error is AADSTS50011 (redirect URI mismatch)
- Consent was granted but calls still fail (scope or permission insufficiency at the API)

## Compatibility

Microsoft Entra ID, Microsoft Graph delegated and application permissions. Same flow for any API permission flagged admin-consent-required.

## Variant phrasings

### aadsts65001 admin consent required graph api

The permission, not the app, triggers it. Find the flagged permission first.

### the user or admin has not consented to use the application

That is the full error text. The fix is the admin grant, not a user retry.

## Why it happens

Entra gates powerful permissions behind admin approval per tenant. When an app requests such a permission and no admin has consented, the token service refuses to issue tokens and returns 65001. It is the security gate doing its job: end-user consent is deliberately insufficient for these permissions.

## Edge cases

- Multi-tenant apps need the grant in every tenant; consent in the home tenant does not travel
- The admin consent workflow must be enabled for users to self-request; otherwise they hit a dead end
- Removing a permission later does not revoke the grant; audit grants periodically

## If it still fails

- Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
- Reproduce with a single test user so you are not debugging a crowd.
- If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

## Prevention

- Track credential and certificate expiry with alerts, not memory.
- Run a synthetic check per app daily so breakage pages you, not a user.
- Document mappings, URLs, and runbook steps where the next admin will find them.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6fX_6Yko_ZOOXaPq1FltSQ