AADSTS65001 Azure Origin: Platform & cloud Last updated 13 Oct 2026

AADSTS65001: The user or administrator has not consented to use the application

The app needs permissions that haven’t been granted for this user or tenant.

Exact message you may see The user or administrator has not consented to use the application
Seen on: Azure

Meaning

Delegated permissions need user or admin consent; many Microsoft Graph permissions need admin consent. Non-interactive flows (client credentials, on-behalf-of, ROPC) can’t show a consent prompt, so they fail with 65001.

Common causes

  • Required permission not consented
  • Admin consent required but only user consent attempted
  • User consent disabled by tenant policy
  • New permission added to the app without re-consent

⚡ Quick fix

  1. Grant admin consent in App registrations → API permissions
  2. Trigger interactive consent with prompt=consent
  3. Ask an admin to approve via the admin consent URL

Detailed fix by platform

Azure CLI

  1. az ad app permission admin-consent --id <app-id>

How to diagnose

  1. Permissions — API permissions list and status
  2. Policy — User consent settings
  3. Flow — Interactive or not?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

403 — HTTP 403 Forbidden (HTTP)403AADSTS500113 — AADSTS500113: No reply address is registered for the application (Azure)AADSTS500113AADSTS50020 — AADSTS50020: User account from identity provider does not exist in tenant and cannot access the application (Azure)AADSTS50020AADSTS50034 — AADSTS50034: The user account does not exist in the directory (Azure)AADSTS50034AADSTS50053 — AADSTS50053: Your account is locked (Smart Lockout) / sign-in blocked due to suspicious activity (Azure)AADSTS50053AADSTS50055 — AADSTS50055: The password is expired (Azure)AADSTS50055AADSTS50105 — AADSTS50105: Your administrator has configured the application to block users unless they are specifically granted access (Azure)AADSTS50105Access to the path is denied — System.UnauthorizedAccessException: Access to the path 'x' is denied (.NET)Access to the path is…AADSTS650…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.