Unable to grant O365 users access to Tech Community

%3CLINGO-SUB%20id%3D%22lingo-sub-127852%22%20slang%3D%22en-US%22%3EUnable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-127852%22%20slang%3D%22en-US%22%3E%3CP%3EHas%20any%20one%20ran%20into%20issues%20authorizing%20Tech%20Community%20with%20federated%20IDs%3F%20If%20I%20log%20in%20with%20a%20GA%2C%20gives%20me%20some%20warnings%20about%20access%2C%20etc...if%20I%20accept%2C%20the%20account%20I%20good%20but%20others%20in%20the%20tenant%2C%20not%20so%20much%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Estates%3A%3C%2FP%3E%3CP%3EYou%20can't%20access%20this%20application%3CBR%20%2F%3EMS%20Tech%20Comm%20needs%20permission%20to%20access%20resources%20in%20your%20organization%20that%20only%20an%20admin%20can%20grant.%20Please%20ask%20an%20admin%20to%20grant%20permission%20to%20this%20app%20before%20you%20can%20use%20it.%3C%2FP%3E%3CP%3EAADSTS90094%3A%20The%20grant%20requires%20admin%20permission.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eif%20I%20drill%20into%20AAD%20I%20see%20the%20app%20but%20its%20specific%20to%20the%20GA%20account%2C%20and%20when%20I%20allow%20graph%20the%20same%20permissions%20for%20the%20tenant%2C%20no%20love...I%20saw%20some%20docs%20about%20a%20parameter%20that%20needs%20to%20be%20placed%20in%20the%20auth%20url%20but%20didn't%20work%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-280732%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-280732%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Dean%2C%20I%20so%20wish%20I%20had%20known%20this%20when%20I%20signed%20up%20to%20the%20community%20originally!%26nbsp%3B%20I%20was%20a%20founding%20member%20and%20member%20of%20the%20week%20-%20but%20all%20that%20is%20gone%20since%20changing%20jobs.%26nbsp%3B%20Frankly%2C%20I%20don't%20even%20see%20the%20benefit%20of%20linking%20to%20Office%20365%20if%20there%20is%20no%20way%20to%20port%20your%20profile%20to%20another%20account%20or%20tenant.%26nbsp%3B%20Guess%20lesson%20learned%20going%20forward!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-136309%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-136309%22%20slang%3D%22en-US%22%3E%3CP%3EI%20would%20not%20recommend%20using%20company%20accounts%20to%20access%20this%20community%20because%20if%20you%20leave%20the%20company%20%2C%20you%20will%20lose%20all%20of%20your%20history%20in%20this%20community.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-135100%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-135100%22%20slang%3D%22en-US%22%3E%3CP%3Enone%20yet...been%20busy%20with%20other%20items%20in%20365%20land...%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-134977%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-134977%22%20slang%3D%22en-US%22%3E%3CP%3EAny%20News%20on%20the%20issue%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-130043%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-130043%22%20slang%3D%22en-US%22%3E%3CP%3ELet%20us%20know%20what%20the%20solution%20is.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-129968%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-129968%22%20slang%3D%22en-US%22%3Ewill%20do%2C%20thanks!%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-128401%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-128401%22%20slang%3D%22en-US%22%3E%3CP%3EUm%2C%20well%20that's%20about%20as%20much%20as%20I%20can%20help%20you%20with%20all%20this%2C%20I'm%20not%20a%20dev%20and%20the%20whole%20app%20model%20is%20still%20something%20I'm%20not%20as%20familiar%20with.%20Maybe%20open%20a%20support%20case%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-128211%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-128211%22%20slang%3D%22en-US%22%3Estill%20no%20love...it%20did%20change%20the%20prompt%20to%20allow%20for%20whole%20org%20in%20the%20permissions%20warning...clicked%20on%20that%20and%20it%20kicked%20me%20out...will%20keep%20messing%20around%20with%20it...its%20not%20the%20best%20documented%20item%20from%20what%20I%20can%20tell...but%20then%20again%20with%20the%20security%20aspect%2C%20I%20can%20see%20why%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-128210%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-128210%22%20slang%3D%22en-US%22%3E%3CP%3EYup%2C%20replace%20the%20endpoint.%20The%20ClientID%20is%20the%20identifier%20of%20the%20application%20-%20you%20can%20compare%20it%20against%20what%20you%20are%20seeing%20in%20the%20Azure%20AD%20portal%20for%20the%20MS%20Tech%20Comm%20app.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAgain%2C%20pay%20attention%20to%20what%20you%20are%20consenting%2C%20as%20there%20have%20been%20some%20baddies%20exploiting%20this%20already%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-128207%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-128207%22%20slang%3D%22en-US%22%3Eso%20basically%20take%20replace%20%22common%2Foauth2%2Fv2.0%2Fauthorize%22%20with%20%22common%2Fadminconsent%22%20that%20is%20provided%20in%20URL%20for%20login...%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-128197%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-128197%22%20slang%3D%22en-US%22%3Emost%20of%20that%20URL%20makes%20sense%20and%20I%20had%20it%20about%2090%25%20there%20but%20kept%20getting%20errors%2C%20but%20the%20client%20ID%2C%20where%20is%20that%20derived%20from%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-128196%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-128196%22%20slang%3D%22en-US%22%3E%3CP%3ESwitch%20it%20to%20No%2C%20try%20accessing%20the%20MTC%20with%20your%20admin%20account%20and%20consent%20to%20the%20app.%20If%20no%20consent%20prompt%20appears%2C%20try%20triggering%20it%20manually%20via%20this%20link%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3Ehttps%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Fadminconsent%2F%3Fclient_id%3D09213cdc-9f30-4e82-aa6f-9b6e8d82dab3%26amp%3Bredirect_uri%3Dhttps%253A%252F%252Ftechcommunity.microsoft.com%252Fauth%252Foauth2callback%26amp%3Bresponse_type%3Dcode%26amp%3Bstate%3Dhttps%253A%252F%252Ftechcommunity.microsoft.com%252F%26amp%3Bscope%3DUser.Read%2Bopenid%2Bemail%2Bprofile%2Boffline_access%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20%22adminconsent%22%20part%20makes%20sure%20that%20it%20will%20trigger%20the%20correct%20flow.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20a%20disclaimer%20to%20never%20click%20such%20links%20without%20double%20and%20triple-checking%20to%20what%20you%20are%20consenting%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-128136%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-128136%22%20slang%3D%22en-US%22%3Eits%20set%20to%20no...even%20flipped%20to%20yes%20and%20assigned%2C%20no%20love%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-127967%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20grant%20O365%20users%20access%20to%20Tech%20Community%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-127967%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20as%20the%20admin%20can%20consent%20to%20the%20app.%20Go%20to%20the%20Azure%20AD%20blade%2C%20navigate%20to%20the%20app%20in%20question%20(O365%20Network%20or%20MS%20Tech%20Comm)%2C%20Properties%2C%20check%20the%20value%20of%20the%26nbsp%3B%22User%20assignment%20required%3F%22%20toggle.%20Should%20be%20set%20to%20No.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Has any one ran into issues authorizing Tech Community with federated IDs? If I log in with a GA, gives me some warnings about access, etc...if I accept, the account I good but others in the tenant, not so much

 

states:

You can't access this application
MS Tech Comm needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.

AADSTS90094: The grant requires admin permission.

 

if I drill into AAD I see the app but its specific to the GA account, and when I allow graph the same permissions for the tenant, no love...I saw some docs about a parameter that needs to be placed in the auth url but didn't work

14 Replies

You as the admin can consent to the app. Go to the Azure AD blade, navigate to the app in question (O365 Network or MS Tech Comm), Properties, check the value of the "User assignment required?" toggle. Should be set to No.

its set to no...even flipped to yes and assigned, no love

Switch it to No, try accessing the MTC with your admin account and consent to the app. If no consent prompt appears, try triggering it manually via this link:

 

https://login.microsoftonline.com/common/adminconsent/?client_id=09213cdc-9f30-4e82-aa6f-9b6e8d82dab3&redirect_uri=https%3A%2F%2Ftechcommunity.microsoft.com%2Fauth%2Foauth2callback&response_type=code&state=https%3A%2F%2Ftechcommunity.microsoft.com%2F&scope=User.Read+openid+email+profile+offline_access

 

 

The "adminconsent" part makes sure that it will trigger the correct flow.

 

And a disclaimer to never click such links without double and triple-checking to what you are consenting :)

most of that URL makes sense and I had it about 90% there but kept getting errors, but the client ID, where is that derived from?
so basically take replace "common/oauth2/v2.0/authorize" with "common/adminconsent" that is provided in URL for login...

Yup, replace the endpoint. The ClientID is the identifier of the application - you can compare it against what you are seeing in the Azure AD portal for the MS Tech Comm app.

 

Again, pay attention to what you are consenting, as there have been some baddies exploiting this already :)

still no love...it did change the prompt to allow for whole org in the permissions warning...clicked on that and it kicked me out...will keep messing around with it...its not the best documented item from what I can tell...but then again with the security aspect, I can see why

Um, well that's about as much as I can help you with all this, I'm not a dev and the whole app model is still something I'm not as familiar with. Maybe open a support case?

will do, thanks!

Let us know what the solution is.

Any News on the issue?

none yet...been busy with other items in 365 land...

I would not recommend using company accounts to access this community because if you leave the company , you will lose all of your history in this community. 

Hi Dean, I so wish I had known this when I signed up to the community originally!  I was a founding member and member of the week - but all that is gone since changing jobs.  Frankly, I don't even see the benefit of linking to Office 365 if there is no way to port your profile to another account or tenant.  Guess lesson learned going forward!