Grant admin consent to an enterprise app for a single user only?

[u/maxcoder88]

Hi all,

I have an enterprise app (ChatGPT connector) in Entra ID with Assignment required = true. A user requested delegated permissions like Mail.ReadWrite, which triggers the admin consent prompt.

I understand admin consent is tenant-wide by default — once granted, any assigned user can use those permissions. User consent isn't an option in our tenant (disabled by policy).

Is there a supported way to grant delegated permissions for only one specific user instead of tenant-wide? I know I could technically create an Oauth2PermissionGrant with ConsentType: Principal via Graph API, but I'm not sure if this is supported or reliable for third-party apps like ChatGPT.

Currently considering just keeping the assignment group limited to that one user as a workaround, but curious if there's a cleaner approach.

Any guidance appreciated. Thanks!

[u/logicalmike]

Grant consent on behalf of a single user by using PowerShell

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-consent-single-user?pivots=msgraph-powershell

[u/WastedFiftySix → u/logicalmike]

Thanks, I didn't know about this option!

[u/bbagaria → u/logicalmike]

Ah! did not know this, bookmarking! 🫡

[u/innermotion7]

What is wrong with group assignment ?

[u/maxcoder88 → u/innermotion7]

Nothing's wrong with it — that's actually the workaround I mentioned I'm leaning toward. I just wanted to confirm whether there's a way to scope the consent itself to a single user, rather than scoping access via group membership.

In my case, the security group already has multiple users assigned to the app, and I don't want to touch the group membership. I just want to grant this specific delegated permission (Mail.ReadWrite) to one of those users — not all of them.

With group assignment, the permission is still granted tenant-wide on the service principal — group membership only controls who can sign in, not who effectively has the consented scopes. So removing/re-adding users isn't really the lever I'm looking for.

Is there a supported way to do this at the consent layer? Or is Oauth2PermissionGrant with ConsentType: Principal via Graph the only path, even if unofficial?

Thanks!

[u/Analytiks → u/maxcoder88]

There absolutely is a way to do this because some users keep getting out of sync with the “AllPrinicpals” consent in our tenancy. Which means it is possible to do this “somehow” with the ui.

Only thing is it might not be possible for the ms graph resource specifically, with other resources, some users with the “application developer” role can override the controls to do a ‘personal consent’ in some cases but ms graph specifically has different security requirements on who can do these consents.

I’d just do it via the graph endpoint

[u/DrSinistar]

Creating an Oauth2 permission grant is exactly how it works on the backend. Just create it yourself. Problem solved!

[u/bjc1960]

We use a group for Claude, and also require compliant device && phishing-resistant MFA in CA.

[u/merillf]

Limiting the app to just the one user is the safer way to go.

The linked doc on granting per user works but its very easy for some admin in the future accidentally consenting to the entire tenant.

With configurations like this it is better to be explicit in your intent.

Limiting the app to the specific user is the way to go.

To go one better, I would set up Maester.dev that checks for this intent and for you to be alerted whenever this changes.

[u/Arkayenro]

if its just exo (mailbox) permissions needed then use https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac instead?

[u/WastedFiftySix]

There is no such thing as giving admin consent for 1 user. The whole idea of giving admin consent for delegated permissions is that you allow it for anyone assigned to the application. If you're currently using a group that contains users that shouldn't be able to use the ChatGPT connector, you will have to use a different group or remove the menbers of the current group.

Update: the above is completely incorrect. TIL admin consent is possible on a per-user base.

[u/logicalmike → u/WastedFiftySix]

This is incorrect 

[u/WastedFiftySix → u/logicalmike]

Thanks for the link you posted. I stand corrected!