I am developping a native app that has to display the Office 365 groups the user is a member of. For this, I call the Microsoft Graph API wich requires authentication. I'm using the ADAL library.
The permissions needed require admin consent. Everything works fine for users from my tenant, but when I try to authenticate with an account of another tenant it doesn't work. It keeps giving this result :
Correlation ID: 9780ed24-9d24-4604-b8bf-28a02c2ea580
Timestamp: 2017-04-14 12:05:45Z
AADSTS70001: Application with identifier 'xxxxxxxx-xxx-xxx-xxxx-xxxxxxxxxxxx' was not found in the directory XXXXXXX.onmicrosoft.com
even if I use an admin account on first connection. I am never asked for consent and the app is not registered on the other tenant.
The app is registered as Native so it should be multi-tenant and I pass "/common" as the tenant in the authority.
I also tried to register an app with the same specifications on the other tenant, gave admin consent on the permissions and it worked as well.
Here is how I retrieve the access token :
private static string GetAccessToken()
{
AuthenticationContext authContext = new AuthenticationContext(authority);
AuthenticationResult authResult = authContext.AcquireToken(graphResource, clientID, redirectURI, PromptBehavior.RefreshSession);
var accessToken = authResult.AccessToken;
return accessToken;
}
Is it a problem within the code?The parameters? Do the other tenants need some 'special azure subscription' I'm not aware of?
In short : How do I get it to work for other tenants?
Edit : I tried to manually add the "prompt=admin_consent" to the request, like this :
AuthenticationResult authResult = authContext.AcquireToken(graphResource, clientID, redirectURI,PromptBehavior.RefreshSession, UserIdentifier.Any, "prompt=admin_consent");
But it triggers an error saying that there is a "Duplicate query parameter 'prompt' in extraQueryParameters"