Microsoft Entra ID: multi-tenant app shows "Approval required" (admin consent) for delegated-only permissions

Service / technology Microsoft Entra ID – App registrations, OAuth 2.0 delegated permissions, user/admin consent.

Scenario We publish a multi-tenant application ("Humassistant"). When users from external tenants try to connect our app, they are shown the "Approval required" screen and are forced to request administrator consent, instead of being able to consent as individual users.

Our app only requests delegated permissions that, to our understanding, should not require admin consent by design.

Result (what happens vs. what we expect)

• Actual: end users get "Approval required" / admin consent prompt and cannot proceed on their own.
• Expected: an individual user can grant consent to our delegated permissions without a tenant administrator having to approve.

Environment

• App registration type: multi-tenant (accounts in any organizational directory).
• Permissions: delegated only (no application/app-role permissions).
• We can share the Application (client) ID and the full list of requested delegated scopes on request.

Troubleshooting already done We have investigated for several days on our side (app registration configuration, requested scopes) without success. Based on the Microsoft article on the admin consent workflow, we suspect the prompt is driven by the customer tenant configuration — the admin consent workflow and/or the user consent settings under Enterprise applications → Consent and permissions → User consent settings — rather than by our app registration.

What we need confirmed (in writing)

1. Do any of our requested delegated scopes force admin consent by themselves, regardless of the tenant settings?
2. Is the "Approval required" prompt determined by the customer tenant's user-consent / admin-consent-workflow settings?
3. What is the exact setting a customer's tenant administrator must change to allow an individual user to consent to our app?