When customers encounter a "Microsoft account requires admin approval" message while trying to access Scispot, despite being granted access, the issue likely stems from security policies within the customer’s Azure Active Directory (Azure AD) environment. Here are steps that the IT team can follow to resolve this issue quickly.
Steps to Resolve:
Check Admin Consent Settings in Azure AD
First verify if your Azure AD configuration requires admin consent for new applications. Sometimes, even though Scispot has granted access, the organization’s security policies might still demand admin approval for each user trying to sign in.
To Check Admin Consent:
Go to the Azure AD Admin Center.
Navigate to Enterprise Applications.
Find and select Scispot from the list.
Review the consent settings under the Permissions tab.
Grant Admin Consent Globally for Scispot
If admin consent has not yet been granted globally for Scispot, this will ensure that all users in the organization can sign in without needing individual approval.
Steps to Grant Global Admin Consent:
Open the Azure AD Admin Center.
Go to Enterprise Applications.
Select Scispot from the list.
Under Permissions, click Grant admin consent for [Organization Name].
Check Conditional Access Policies
It is important to also verify if any Conditional Access Policies are blocking access for the specific user or group trying to log into Scispot. These policies might unintentionally prevent certain users from signing in.
Verify Microsoft Single Sign-On (SSO) Configuration
Ensure that the Microsoft Single Sign-On (SSO) setup is configured correctly. Specifically, check that the appropriate scopes like
openid,profile, andemailare included in the permissions.To Review SSO Configuration:
Go to Azure AD Admin Center.
Select Scispot in the Enterprise Applications.
Navigate to the Single Sign-On tab and review the settings.
Clear User Consent Requirement
In some organizations, even after admin consent, individual users might still be prompted to grant consent. To avoid this, you can set the app’s user assignment as required and ensure that all users needing access to Scispot are explicitly assigned.
To Set User Assignment:
Go to Azure AD Admin Center.
Select Scispot in Enterprise Applications.
In the Properties tab, set User assignment required to Yes.
Assign the users manually who need access.
Additional Troubleshooting
If these steps do not resolve the issue, please review their organization’s security settings and ensure that no additional security measures are unintentionally blocking Scispot. Some scenarios might require deeper analysis of Azure AD logs to identify where the sign-in is being blocked.
By following these steps, you can ensure that all users in their organization can sign in to Scispot smoothly and without unnecessary admin approval prompts.
Key Takeaways:
Confirm Azure AD consent settings for new applications.
Grant global admin consent for Scispot.
Review conditional access policies.
Verify SSO permissions are correctly configured.
Ensure users are assigned access to Scispot to bypass individual consent requirements.
Following this checklist should help resolve access issues quickly for the Scispot platform.