App proxy issues - requesting permission approval and reporting I'm not authorised to access

Question

App proxy issues - requesting permission approval and reporting I'm not authorised to access

Matt Chapman 0

I'm having issues with an enterprise app which is configured to provide an on premises application access to Azure, provide SSO to that app's web interface and access to this via App Proxy.

The app hasn't been updated for some time and everything has been working fine in the past, but at the moment when I try to access the web interface, I'm being prompted to approve the API permissions for the app and then get a message that I'm not authorised to access the app - I'm definitely in the app's "Users and groups".

The API permissions have all been approved previously and I've also re-granted permissions for my tenant today.

When launching the web interface on my local network, the SSO works fine.

The app itself is able to connect to Azure and modify as it should so the permissions are fine.

Sridevi Machavarapu 27,315 Reputation points Microsoft External Staff Moderator

2026-04-07T17:11:52.2566667+00:00
Hello Matt Chapman,

Since the app works fine internally and the issue only occurs via App Proxy, this points to the authentication flow on the Azure side rather than the application itself.

Check API permissions in the App Registration and confirm admin consent is fully granted

Verify user assignment in the Enterprise Application (direct assignment or valid group)

Review Sign-in logs in Entra ID for the failed attempt (check failure reason and Conditional Access details)

Try accessing the app in an InPrivate/Incognito window to rule out cached session issues

This is most commonly due to a consent issue or a policy affecting App Proxy access. If you can share the error code or correlation ID from the logs, I can help narrow it down further.
Sridevi Machavarapu 27,315 Reputation points Microsoft External Staff Moderator

2026-04-08T23:03:40.4566667+00:00

Hello Matt Chapman,

Any update on this? Please confirm if you still have further queries on this.
Matt Chapman 0 Reputation points

2026-04-10T12:02:07.4166667+00:00
Hi @Sridevi Machavarapu

Apologies for the delay on this.

The API permissions are all granted in the app reg.

I'm assigned to the enterprise app both directly and via a group. I have tried removing the direct assignment but that hasn't made any difference.

The signin logs show some success and some failures. I'm running some tests to confirm, but I suspect the successes are when I have enabled my global admin role.

I've tried the app in in-private windows, other browsers and other user accounts.

The app is working fine when the on premises product is using it to manipulate Entra objects. The App Proxy is only there to provide access to the internal web portal with SSO.

SSO is working fine when loading the web portal over the local LAN.

1 answer

Your answer

Sridevi Machavarapu 27,315 Reputation points Microsoft External Staff Moderator

2026-04-07T17:11:52.2566667+00:00

Hello Matt Chapman,

Since the app works fine internally and the issue only occurs via App Proxy, this points to the authentication flow on the Azure side rather than the application itself.

Check API permissions in the App Registration and confirm admin consent is fully granted

Verify user assignment in the Enterprise Application (direct assignment or valid group)

Review Sign-in logs in Entra ID for the failed attempt (check failure reason and Conditional Access details)

Try accessing the app in an InPrivate/Incognito window to rule out cached session issues

This is most commonly due to a consent issue or a policy affecting App Proxy access. If you can share the error code or correlation ID from the logs, I can help narrow it down further.
Sridevi Machavarapu 27,315 Reputation points Microsoft External Staff Moderator

2026-04-08T23:03:40.4566667+00:00

Hello Matt Chapman,

Any update on this? Please confirm if you still have further queries on this.
Matt Chapman 0 Reputation points

2026-04-10T12:02:07.4166667+00:00

Hi @Sridevi Machavarapu

Apologies for the delay on this.

The API permissions are all granted in the app reg.

I'm assigned to the enterprise app both directly and via a group. I have tried removing the direct assignment but that hasn't made any difference.

The signin logs show some success and some failures. I'm running some tests to confirm, but I suspect the successes are when I have enabled my global admin role.

I've tried the app in in-private windows, other browsers and other user accounts.

The app is working fine when the on premises product is using it to manipulate Entra objects. The App Proxy is only there to provide access to the internal web portal with SSO.

SSO is working fine when loading the web portal over the local LAN.

Answer 1

Matt Chapman 0

Hi

I've managed to resolve my issue by

Removing the SSO and app proxy settings from the existing enterprise app
Creating a new EA for the web portal access and SSO only

I guess there's new security around enterprise apps which have enhanced API permissions and SSO / App proxy access and user delegated rights.

0 comments

Share via

App proxy issues - requesting permission approval and reporting I'm not authorised to access

1 answer

Your answer