AADSTS65001 — "The user or administrator has not consented to use the application." The app requests delegated or application permissions for which no consent grant exists for this user or tenant. Entra ID will not issue tokens containing permissions nobody agreed to. Common on first run of new apps, after adding new permissions, and in tenants where user consent is disabled.
AADSTS65001
No consent for the application
What it means
Common causes
Tenant policy disables user consent, and no admin has consented on the tenant's behalf.
The app added new permission scopes since consent was last granted, invalidating the old grant's coverage.
Application permissions (app-only) are requested, which always require admin consent.
The consent was granted in a different tenant than the one now being used.
How to fix it
Grant admin consent: Entra admin center > App registrations > (app) > API permissions > Grant admin consent for (tenant); or Enterprise applications > (app) > Permissions.
Alternatively drive the admin-consent flow with the URL
https://login.microsoftonline.com/{tenant}/adminconsent?client_id={appId}.For user-consentable scenarios, review consent settings: Entra admin center > Enterprise applications > Consent and permissions.
Request only needed scopes, and use incremental consent (request scopes when features need them) to reduce consent friction.