Admin consent is the mechanism by which a global administrator authorizes an application to access an Entra ID tenant with specific permissions. For application permissions, which operate without a signed-in user, admin consent is mandatory.
How the flow works#
A multi-tenant application publishes the permissions it requires. An administrator opens the vendor's admin-consent link, signs in, reviews the requested permissions, and grants them once for the whole tenant. The grant is recorded on an enterprise application object, is visible in the portal afterwards, and can be revoked at any time.
What to check before granting#
The permission list is the contract. Review it, not the marketing page:
- Are the permissions read-only, or do they include write access to the directory?
- Is each permission explicable by a visible product feature?
- Does the vendor document the exact list, so you can compare it against the consent prompt?
VisualizerEngine
Consent in VisualizerEngine
Onboarding is a standard Entra admin-consent link requesting exactly three application permissions, all read-only: Group.Read.All, User.Read.All, and Organization.Read.All. Nothing more is requested, nothing is installed, and the platform cannot modify your directory.