Microsoft Entra ID Admin Consent Roles for Enterprise Applications
Short answer
Identify users assigned the Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator roles for each application requiring admin consent.
Question
You have a Microsoft Entra tenant named contoso.com that contains the users shown in the following table.
You add enterprise applications to contoso.com as shown in the following table.
You need to identify which users can grant admin consent for App1 and App2.
Which users should you identify for each application? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
The core concept is identifying specific Entra ID roles that permit granting tenant-wide admin consent, a common trap being confusing app ownership with administrative permissions.
Determines which users can grant admin consent for enterprise applications in Microsoft Entra ID based on assigned privileged roles. Establishes that only Global Administrator, Privileged Role Administrator, Cloud Application Administrator, and Application Administrator have this capability.
Common mistake: Selecting users who own the application or are assigned to it as 'Owner' or 'Member', assuming these roles allow granting admin consent without checking for specific high-privilege Entra ID roles.
Expert Analysis
Why the Answer Is Correct
Admin consent allows an administrator to grant permissions on behalf of the entire organization. In Microsoft Entra ID, this action is restricted to users holding specific privileged roles: Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator. Therefore, you must identify users in the provided table who hold one of these four roles to answer correctly for App1 and App2.
Why Other Candidate Answers Are Wrong
Users with standard roles like User, Member, or even Owner of the application itself cannot grant tenant-wide admin consent unless they also hold one of the specified privileged roles. Ownership of the app registration does not confer the right to grant admin consent; only the specific Entra ID administrative roles do.
Community Comment Notes
As mcdesilva74 noted, granting tenant-wide admin consent requires a privileged Entra role. The comment correctly lists the valid roles: Global Administrator, Privileged Role Administrator, Cloud Application Administrator, and Application Administrator. This aligns with the official Microsoft documentation regarding application consent workflows.
Official Reference
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent
This link opens the official vendor documentation in a new tab.
Exam Strategy
Memorize the four specific Entra ID roles that can grant admin consent. When analyzing user tables, ignore app ownership and focus solely on whether the user holds one of these four titles.
Frequently Asked Questions
Can an Application Owner grant admin consent?
What are the roles for granting admin consent in Entra ID?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
mcdesilva74 👍 1Granting tenant-wide admin consent requires a privileged Entra role. Owning the app or being assigned to it isn’t enough. The roles that can grant admin consent are: Global Administrator Privileged Role Administrator Cloud Application Administrator Application Administrator
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →