title: Azure Data Lake Storage Gen2 access token generation - "AADSTS65001: The user or administrator has not consented to use the application with ID
body: <p>I'm trying to generate access and refresh tokens to be able to sign in to the Azure Data Lake Storage Gen2 using external application with allows OAuth. </p>
  
  <p>What was done:</p>
  
  <ol>
  <li><p>Created Storage account using <a href="https://docs.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-quickstart-create-account" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-quickstart-create-account</a></p></li>
  <li><p>Created Azure AD application using <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal</a></p></li>
  <li><p>Granted admin consent to application from the 2nd step - <a href="https://i.imgur.com/myMtkeu.png" rel="nofollow noreferrer">https://i.imgur.com/myMtkeu.png</a></p></li>
  <li><p>Also granted admin consent to enterprise apps with name as the app from step 2 
  <a href="https://i.imgur.com/BPX48NE.png" rel="nofollow noreferrer">https://i.imgur.com/BPX48NE.png</a></p></li>
  </ol>
  
  <p>Steps 3 and 4 were done as described here - <a href="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent#grant-admin-consent-when-registering-an-app-in-the-azure-portal" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent#grant-admin-consent-when-registering-an-app-in-the-azure-portal</a></p>
  
  <p>Then I generated authorization code </p>
  
  <pre><code>https://login.microsoftonline.com/&lt;TENANT ID&gt;/oauth2/v2.0/authorize?client_id=&lt;CLIENT ID&gt;&amp;response_type=code&amp;redirect_uri=https%3A%2F%2Flocalhost%2Fmyapp%2F&amp;response_mode=query&amp;scope=offline_access%20user.read%20mail.read&amp;state=12345
  </code></pre>
  
  <p>After that I tried to get the token</p>
  
  <pre><code>curl -X POST https://login.microsoftonline.com/&lt;TENANT ID&gt;/oauth2/token \
   -F redirect_uri=https://localhost/myapp/ \
   -F grant_type=authorization_code \
   -F resource=https://management.core.windows.net/ \
   -F client_id=&lt;CLIENT ID&gt; \
   -F client_secret=&lt;CLIENT SECRET&gt; \
   -F code=OAQABAAIAAAAP0wLlqdLVToOpA4kwzSnxLhHJrARX8557... (Authorization code)
  </code></pre>
  
  <p>As a result received the error below</p>
  
  <pre><code>"error":"invalid_grant","error_description":"AADSTS65001: 
  The user or administrator has not consented to use the application with ID
  '&lt;CLIENT ID&gt;' named '&lt;APP NAME&gt;'. Send an interactive authorization request 
  for this user and resource.\r\nTrace ID: &lt;TRACE ID&gt;\r\nCorrelation ID: 
  &lt;CORRELATION ID&gt;\r\nTimestamp: 2019-09-03 13:31:50Z","error_codes":[65001],
  "timestamp":"2019-09-03 13:31:50Z","trace_id":"&lt;TRACE ID&gt;",
  "correlation_id":"&lt;CORRELATION ID&gt;","suberror":"consent_required"```
  </code></pre>