# SSO OAuth v2 (Azure)

**URL:** <https://forum.pritunl.com/t/sso-oauth-v2-azure/2566>\
**Category:** Pritunl VPN\
**Tags:** pritunl\
**Created:** [October 30, 2024, 7:30am UTC](https://forum.pritunl.com/t/sso-oauth-v2-azure/2566 "2024-10-30T07:30:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![julianb](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/j/d2c977/32.png) [@julianb](https://forum.pritunl.com/u/julianb)\
**Post date:** [October 30, 2024, 7:30am UTC](https://forum.pritunl.com/t/sso-oauth-v2-azure/2566/1 "2024-10-30T07:30:04Z")

</div>

I’m experiencing some issues with Single Sign-On (SSO) after transitioning from Global OAuth v1 to Global OAuth v2 (Azure).

While everything works with v1, switching to v2 triggers a “Needs approval” prompt for users every time they attempt to log in. I’ve tried granting approval for the enterprise app multiple times, but the process just loops, endlessly requesting new approvals.

It seems like there might be a missing configuration in the setup for v2.

**Error from Azure:**

> > Failure reason   
> > Admin consent is required for the permissions requested by this application. An admin consent request may be sent to the admin.

Does anyone know who to get this working?

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [October 30, 2024, 12:11pm UTC](https://forum.pritunl.com/t/sso-oauth-v2-azure/2566/2 "2024-10-30T12:11:16Z")

</div>

I’m not sure what the cause of this is, it seems to be a very limited number of users. The OAuth v1 will continue to be available until it is discontinued by Microsoft.

---

<div class="post-metadata">

**Author:** ![cbailey](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@cbailey](https://forum.pritunl.com/u/cbailey)\
**Post date:** [April 4, 2025, 12:44am UTC](https://forum.pritunl.com/t/sso-oauth-v2-azure/2566/3 "2025-04-04T00:44:49Z")

</div>

Did you ever work this out? I’m seeing the same behaviour. Switching to v1 seems OK, but that feels more like a workaround.

I do see some things [elsewhere](https://learn.microsoft.com/en-us/answers/questions/789398/admin-consent-repeatedly-asks-for-the-same-permiss), that:

“it’s possible the app is calling the consent endpoint directly, which is something the app publisher should resolve.”

Now, since I don’t have the ability to modify/see what is in the actual app (that’s the bit running on the [Pritunl.com](http://Pritunl.com) server), I am left to try the current v1 endppoint, which seems fine, but the v2 is.. patchy. It works, but I also see the consent request every time (like you describe above).