What causes AADSTS90094?

The Power BI Embedded application requests API permissions (such as Power BI Service delegated or application permissions) that are classified as requiring admin consent, and the initial consent grant was never completed by an admin. New API permission scopes were added to the app registration after initial setup without a subsequent admin consent grant being performed. The application is registered in a tenant where users are restricted from consenting to any application permissions, making admin consent mandatory for all apps. A first-time deployment in a new tenant where the Power BI application permissions have not been previously authorized by a Global Administrator

How do I fix AADSTS90094?

Step 1: Navigate to Azure portal > Microsoft Entra ID > App Registrations > select your app > API Permissions to review all requested permissions and identify which ones are marked as requiring admin consent. Step 2: Have a Global Administrator or Privileged Role Administrator sign into the Azure portal and click 'Grant admin consent for [Tenant Name]' on the API Permissions page of the app registration. Step 3: Verify that all required Power BI Service permissions (such as Dataset.ReadWrite.All, Report.ReadWrite.All, or Workspace.Read.All) show a green checkmark indicating admin consent has been granted. Step 4: If the admin consent button is not visible, confirm the logged-in user has the Global Administrator or Application Administrator role in Microsoft Entra ID. Step 5: After granting consent, retry the token acquisition flow and confirm the AADSTS90094 error no longer appears in authentication logs

High severitypermissions

Power BI Refresh Error:
AADSTS90094

What does this error mean?

AADSTS90094 occurs when a Power BI Embedded application attempts to acquire permissions that require tenant-level administrator consent, but that consent has not yet been granted. The application cannot proceed until an Azure AD admin explicitly approves the requested permission scopes.

Common causes

1The Power BI Embedded application requests API permissions (such as Power BI Service delegated or application permissions) that are classified as requiring admin consent, and the initial consent grant was never completed by an admin
2New API permission scopes were added to the app registration after initial setup without a subsequent admin consent grant being performed
3The application is registered in a tenant where users are restricted from consenting to any application permissions, making admin consent mandatory for all apps
4A first-time deployment in a new tenant where the Power BI application permissions have not been previously authorized by a Global Administrator

How to fix it

1Step 1: Navigate to Azure portal > Microsoft Entra ID > App Registrations > select your app > API Permissions to review all requested permissions and identify which ones are marked as requiring admin consent
2Step 2: Have a Global Administrator or Privileged Role Administrator sign into the Azure portal and click 'Grant admin consent for [Tenant Name]' on the API Permissions page of the app registration
3Step 3: Verify that all required Power BI Service permissions (such as Dataset.ReadWrite.All, Report.ReadWrite.All, or Workspace.Read.All) show a green checkmark indicating admin consent has been granted
4Step 4: If the admin consent button is not visible, confirm the logged-in user has the Global Administrator or Application Administrator role in Microsoft Entra ID
5Step 5: After granting consent, retry the token acquisition flow and confirm the AADSTS90094 error no longer appears in authentication logs

Frequently asked questions

Can a non-admin developer grant the required permissions themselves?

No. Permissions that require admin consent can only be granted by a Global Administrator, Application Administrator, or Cloud Application Administrator in Microsoft Entra ID. A non-admin user attempting to consent will see a message indicating they need admin approval, and the grant will not succeed.

Will granting admin consent affect other applications or users in the tenant?

Admin consent grants permissions to the specific application registration you select — it does not affect other apps. However, it does allow the app to act on behalf of any user in the tenant (for delegated permissions) or as itself (for application permissions), so review the exact permissions being granted carefully before approving.