Application Proxy requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 50fd843 · +46 −0 lines · also on GitHub
⋯ 18 unchanged lines
1919
In this tutorial, you:
2020
- Install and verify the connector on your Windows server, and register it with application proxy.
2121
- Add an on-premises application to your Microsoft Entra tenant.
22
+- Grant admin consent for User.Read permission
2223
- Verify a test user can sign in to the application by using a Microsoft Entra account.
2324
25
+> [!IMPORTANT]
26
+> Starting June 30, 2026, Microsoft Entra application proxy no longer automatically grants admin consent for the **User.Read** delegated permission when you create a new application proxy enterprise application. You must now explicitly grant this permission after creating the application.
27
+>
28
+> This change applies only to **newly created** application proxy applications. Existing applications are not affected.
2429
2530
## Prerequisites
2631
⋯ 49 unchanged lines
7681
| **Validate Backend TLS Certificate** | Select to enable backend Transport Layer Security (TLS) certificate validation for the application. |
7782
7883
1. Select **Add**.
84
+
85
+## Grant admin consent
86
+
87
+After creating a new application proxy application, grant admin consent for the **User.Read** delegated permission in the Microsoft Entra admin center or using the Microsoft Graph PowerShell.
88
+
89
+### [Microsoft Entra admin center](#tab/microsoft-entra-admin-center)
90
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](/entra/identity/role-based-access-control/permissions-reference#cloud-application-administrator).
91
+2. Browse to **Identity** > **Applications** > **Enterprise applications**.
92
+3. Select the newly created application proxy application.
93
+4. Select **Permissions** in the left navigation.
94
+5. Select **Grant admin consent for [your tenant]**.
95
+6. Review the permissions and select **Accept**.
96
+
97
+### [Microsoft Graph PowerShell](#tab/microsoft-graph-powershell)
98
+```powershell
99
+# Connect with the required scope
100
+Connect-MgGraph -Scopes "Application.ReadWrite.All", "DelegatedPermissionGrant.ReadWrite.All"
101
+
102
+# Define variables
103
+$appObjectId = "<your-enterprise-app-object-id>"
104
+$microsoftGraphId = "00000003-0000-0000-c000-000000000000" # Microsoft Graph
105
+$userReadPermissionId = "e1fe6dd8-ba31-4d61-89e7-88639da4683d" # User.Read
106
+
107
+# Get the service principal for your app
108
+$sp = Get-MgServicePrincipal -Filter "id eq '$appObjectId'"
109
+
110
+# Get the Microsoft Graph service principal
111
+$graphSp = Get-MgServicePrincipal -Filter "appId eq '$microsoftGraphId'"
112
+
113
+# Create the delegated permission grant
114
+New-MgOauth2PermissionGrant -ClientId $sp.Id `
115
+ -ConsentType "AllPrincipals" `
116
+ -ResourceId $graphSp.Id `
117
+ -Scope "User.Read"
118
+```
119
+
120
+### Verify the permission was granted
121
+
122
+1. In the Microsoft Entra admin center, navigate to your enterprise application.
123
+2. Select **Permissions**.
124
+3. Confirm that **User.Read** appears under **Admin consent** with Type **Delegated** and Granted through **Admin consent**.
79125
80126
## Test the application
81127
⋯ 61 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:15 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.