title: Identify admin permissions required by an Azure AD app registration
body: <p><strong>How can I find out what admin permissions are blocking the user from signing in to an Azure AD app?</strong></p>
  
  <p>I am setting up an App Registration in the Azure AD portal to be used with my Service Fabric cluster. The app registration does basic auth and only has one Required Permission configured: Sign in and read user profile (which does NOT require admin permission).</p>
  
  <p>My tenant has the "Users can consent to apps accessing company data on their behalf" setting to "Yes", so it's not that.</p>
  
  <p>Also, the <code>/authorize</code> request doesn't have any resource parameter, so it's implicitly asking for the permission I configured: Azure AD's Sign in and read user profile.</p>
  
  <p>However when an non-admin user attempts to sign it, I still get the error:</p>
  
  <blockquote>
    <p>AADSTS90094: The grant requires admin permission</p>
  </blockquote>
  
  <p><a href="https://i.stack.imgur.com/7Z70u.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/7Z70u.png" alt="AADSTS90094: The grant requires admin permission Error screenshot"></a></p>
  
  <p><a href="https://i.stack.imgur.com/fnitd.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fnitd.png" alt="Required permissions only Windows Azure Active Directory screenshot"></a></p>
  
  <p><a href="https://i.stack.imgur.com/NcLqV.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/NcLqV.png" alt="Required permission details only non-admin Sign in and read user profile screenshot"></a></p>
  
  <p><a href="https://i.stack.imgur.com/AptkY.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/AptkY.png" alt="Enterprise apps - Users can consent to apps accessing companty data on their behalf - Yes screenshot"></a></p>