AADSTS90093: Caller cannot agree due to lack of permissions

Question

I get the following error when non-global administrators try to access Graphics Explorer 2 from our tenant:

Additional technical information:

Correlation Id: 2346b0f5-bb5f-4138-8f9d-07fa96dcf02f Timestamp: 2015-05-29 17: 18: 48Z AADSTS90093: The caller cannot agree due to a lack of permissions.

As part of Azure, we have "users can allow applications access to their data." We also have “users can add integrated applications” to “yes.”

Answer 1

, URL . 2 " " - API Azure AD, ( API-) API Office 365.

https://graphexplorer2.cloudapp.net - (AAD) . , , , .

https://graphexplorer2.azurewebsites.net - API-, - API- . , , , ( ).

, ,

Answer 2

, :

• AD (https://manage.windowsazure.com/)
• "" " ", " "" Window Azure Active Directory ".
• , . " " " .
• https://graph.microsoft.io/en-us/docs/authorization/permission_scopes

Answer 3

I worked in Skype for online business use (WEB API). I ran into this problem for non-global admins users. Users added by the global administrator.

I managed to solve the problem by passing the optional parameter prompt = admin_consent .

var href = 'https://login.microsoftonline.com/common/oauth2/authorize?response_type=token&client_id=';
    href += client_id + '&resource=https://webdir.online.lync.com&redirect_uri=' + window.location.href+'&prompt=admin_consent';

For details, see the link https://blogs.msdn.microsoft.com/exchangedev/2014/03/25/using-oauth2-to-access-calendar-contact-and-mail-api-in-office-365-exchange- online /