What causes AADSTS65001?

The app requests a delegated scope (e.g. Power BI Service, Dataset.Read.All, Microsoft Graph) that the user has never consented to. Admin-restricted permissions are requested but no Global Administrator has granted tenant-wide admin consent. Tenant policy 'Users can consent to apps' is disabled, so individual user consent silently fails. The app registration's required API permissions were changed/added but consent was never re-granted. Wrong client ID / multi-tenant app used in a tenant where it has never been provisioned via consent

How do I fix AADSTS65001?

Have a Global Administrator open Entra ID → Enterprise applications → select the app → Permissions → 'Grant admin consent for ' to consent on behalf of all users. If admin consent is not desired, trigger an interactive sign-in with prompt=consent (e.g. https://login.microsoftonline.com/ /oauth2/v2.0/authorize?...&prompt=consent) so the user can consent themselves. In the App registration → API permissions, verify every required scope is listed and shows status 'Granted for '; remove unused scopes that block consent. Check Entra ID → Enterprise applications → Consent and permissions: if user consent is disabled, either enable it or route all consent through an admin. For Power BI embedded / service principal scenarios, ensure the SP is added to the Power BI workspace and that 'Service principals can use Power BI APIs' is enabled in the Power BI admin portal

Low severityauthentication

Power BI Error:
AADSTS65001

What does this error mean?

User or admin hasn't granted consent for the app's delegated permissions on this Microsoft Entra ID (Azure AD) tenant.

Common causes

1The app requests a delegated scope (e.g. Power BI Service, Dataset.Read.All, Microsoft Graph) that the user has never consented to
2Admin-restricted permissions are requested but no Global Administrator has granted tenant-wide admin consent
3Tenant policy 'Users can consent to apps' is disabled, so individual user consent silently fails
4The app registration's required API permissions were changed/added but consent was never re-granted
5Wrong client ID / multi-tenant app used in a tenant where it has never been provisioned via consent

How to fix it

1Have a Global Administrator open Entra ID → Enterprise applications → select the app → Permissions → 'Grant admin consent for <tenant>' to consent on behalf of all users
2If admin consent is not desired, trigger an interactive sign-in with prompt=consent (e.g. https://login.microsoftonline.com/<tenant>/oauth2/v2.0/authorize?...&prompt=consent) so the user can consent themselves
3In the App registration → API permissions, verify every required scope is listed and shows status 'Granted for <tenant>'; remove unused scopes that block consent
4Check Entra ID → Enterprise applications → Consent and permissions: if user consent is disabled, either enable it or route all consent through an admin
5For Power BI embedded / service principal scenarios, ensure the SP is added to the Power BI workspace and that 'Service principals can use Power BI APIs' is enabled in the Power BI admin portal

Frequently asked questions

What does AADSTS65001 mean?

The user or administrator hasn't consented to use the application with ID X. Send an interactive authorization request for this user and resource.

How do I fix this error?

Check your application registration, token configuration, and user permissions in the Azure portal. Review Conditional Access policies if the error is policy-related.

Source · learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes#aadsts-error-codes