## Error message
```text
AADSTS65001: The user or admin has not consented to use the application with ID '[app-id]'. Send an interactive authorization request for this user and resource.
```

## TL;DR
The app works, but nobody has approved its requested permissions in your tenant yet. Have an admin open the app registration in Entra ID, review the API permissions, and click Grant admin consent. Then ask the user to sign in again in a fresh session.

## Steps
1. In Entra ID, open Enterprise applications, find the app by name, and note the application ID from the error.
   Expected: The app record opens and its sign-in log shows recent failed attempts with error 65001.
2. Open API permissions on the app registration and list any permission showing Not granted for [tenant].
   Expected: You see the exact delegated or application permissions the app needs.
3. Have a privileged admin click Grant admin consent for [tenant] and confirm.
   Expected: The status column flips to Granted for every required permission.
4. Ask the user to sign out fully, close the browser, and sign in again to the app.
   Expected: Sign-in succeeds and the app loads its data without the 65001 error.

## When to use
- AADSTS65001 appears for every user of one specific app
- A new SaaS app was just connected to Entra ID and nobody can sign in
- The app registration lists permissions with status Not granted

## When not to use
- Only one user is affected (check that user's assignment instead)
- The error is AADSTS50011 reply URL mismatch (different fix)
- The app needs per-user consent and policy forbids admin consent

## Why this happens
Entra ID never lets an app touch user data or directory APIs without recorded consent. If the app requests permissions after its first deployment, or was consented in a test tenant but not production, every sign-in fails with 65001 until an admin records org-wide consent.

## Edge cases
- Some apps need a user to accept a consent screen themselves; admin consent does not cover those interactive flows.
- If permissions were changed after consent, the grant must be repeated for the new permissions.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_KZd40WTfeY5ON_9igUfAcA