Please add steps for granting Azure permissions on behalf of users about aad-sso-wordpress HOT 2 OPEN

I figured this out after some calls with Microsoft and working with one of our Azure Global Admins:

After SSO is setup, the application needs to be ‘trusted’ by an Azure AD Global Admin, if all internal users will use the application as an authenticated user. Otherwise, each of your users will need to choose to trust the application on first use. The Global Admin can setup trust on behalf of all users by executing a special URL for your application:

Sample URL
https://login.windows.net/common/oauth2/authorize?response_type=code&resource=https%3A%2F%2Fgraph.windows.net&client_id=########-####-####-####-############&prompt=admin_consent&redirect_uri=https%3A%2F%2F[WWW.YOURDOMAIN.COM]%2Fwp-login.php

Sample URL deconstructed:
https://login.windows.net/common/oauth2/authorize?response_type=code&resource=https%3A%2F%2Fgraph.windows.net&
This part logs into Azure and sets the stage for asking for access to graph.windows.net (AKA Graph API/Azure AD)

client_id=########-####-####-####-############&
This part is the client ID setup in the Azure Active Directory ‘Applications’ configuration, unique to each app we register to Azure AD.

prompt=admin_consent&
This part prompts the Azure AD Admin to grant, on behalf of all users, permission to read the user profile from Azure AD

redirect_uri=https%3A%2F%2F[WWW.YOURDOMAIN.COM]%2Fwp-login.php
This is the URI to which Azure AD will redirect the user-agent in response to an OAuth 2.0 request.

from aad-sso-wordpress.

I'm actually going to re-open the issue as a bug, since we really do need to provide better guidance on the option to provide admin consent to the app. Thanks for bringing it up!

from aad-sso-wordpress.