Feedback: Document 'Permissions requested' popup during sign in

[oshihirii]

After reading the the Implement sign-in section on:

https://docs.microsoft.com/en-us/graph/tutorials/javascript?tutorial-step=3

I clicked 'Sign in' and there was a popup window with several permissions requested.

This threw me off a bit because it was not documented on the tutorial page.

So i think it would be good if it was documented on that page, with a description of what each permission meant and which options should be selected (in the popup window).

Additionally, I remembered I had seen a section in a video tutorial about granting 'Admin consent' in the API Permissions section of the App Registrations area that removed the need for users to have to provide consent:

Video: https://youtu.be/93j0MmRruFo?t=230
Relevant Section: 3:50
Video Title: Getting Started with Microsoft Graph and Application Registration
Embedded on: https://docs.microsoft.com/en-us/graph/auth-register-app-v2

So I did that step, refreshed the page and clicked 'Sign In' and still got the 'Permissions requested' popup.

Is that expected behaviour?

Thank You.

[jasonjoh]

Thanks for the feedback. Here's the popup:

• Sign you in and read your profile: The User.Read scope requested by the app. Allows you to do GET /me.
• Read your calendars: The Calendars.Read scope requested by the app. Allows you to do GET /me/calendars.
• Maintain access to data you have given it access to: This is the offline_access scope, which the app does not explicitly request, but msal.js adds this scope to requests. It is this permission that allows the app to silently get new access tokens when the original one expires, without having to re-authenticate the user.

If you give admin consent to all of the Graph scopes the app uses for the app ID used by the app, then no, you should not be prompted (I just tested this to confirm with this sample). That means you have to go add Calendars.Read to the API permissions on the app registration, then grant Admin consent. I mention this because the tutorial doesn't preconfigure API permissions for Graph, and instead uses dynamic permissions by sending them in the authentication request. User.Read is there by default.

[oshihirii]

Thank you for the information.