The connection was denied because the user account is not authorized for remote login

Using Terminal Server 2008 not able to get non administrator users to login to the remote desktop. Have tried from Windows server 2008 and from Windows servers 2003. Get error login in "The connection was denied because the user account is not authorized for remote login" from Windows Server 2008. Error "The requested session access is denied" from Windows Server 2000.

Is that seriously the only way to do this? Doesn't this render the "Allow log on through Terminal Services" GP Setting useless?
I would like to know this answer, as well. I have created a new AD group for my assistant admins called "Domain Admins (limited)". I have added this group to the GP setting "Allow log on through Terminal Services", but the
assistant admins cannot log in through RDP. It 'feels like' this is all I would need to do.
Craig
Found some good info
here. There are really two things required for a user to connect to a server via RDP. You can configure one of them via Group Policy but not the other.
1) Allow log on through Terminal Services can be configured through Group Policy, no problem.
2) Permissions on the RDP-listener must also be granted. If your user is a member of the local Administrators group or the local Remote Desktop Users group then this is handled. If you are trying to utilize a new, custom group (as I am),
then there isn't a way to do this via group policy (that I have found).
EDIT: Found the answer. I am creating a blog post to outline the steps. They aren't hard, but they're not self-explanatory. It deals with the Restricted Groups mentioned above, but it's still automate-able using Group Policy so that you
don't have to touch each computer. I think the above poster (Andrey Ganev) got it right, but
I had trouble deciphering his instructions.
Here is my blog post that walks through this entire process, step-by-step.

Similar Messages

Error 812: The connection was prevented because of a policy configuration on your RAS/VPN server

Hi,
Just wondering if anyone can help.
We have set up RAS/VPN on our Windows Server 2012 Essentials server. One of our users when trying to log in gets the below error when trying to connect to VPN:
"Error 812: The connection was prevented because of a policy configuration on your RAS/VPN server. Specifically the authentication method used by the server to verify your username and password may not match the authentication method configured in your
connection profile. Please contact the Administrator of the RAS server and notify them of this error."
The domain admin account can log in to VPN fine and any new AD account that I create can log in fine, but just not this particular user account. I checked that this account has "Dial In" access on their user account on AD and on the Anywhere Access
tab on the users properties in Windows server 2012 Essentials Dashboard the "Allow Virtual Private Network (VPN)" is ticked. They are a member of the RA_AllowVPNAccess security group.
I also configured the authentication protocol MS-CHAPv2 on the server and on the client. I also tried to connect using PPTP rather than automatic, with no luck.
I did some searching on the Internet, but virtually all of the resolutions for this issue are related to setup or configuration problems that would result in the VPN either consistently working or not-working. I tried changing a number of the NPS policies,
since the error seemed to point to an NPS issue, but this did not resolve the problem.
I'm buffled why just this user cannot connect to VPN.
Any thoughts?

Hi,
à
The domain admin account can log in to VPN fine and any new AD account that I create can log in fine, but just not this particular user account.
It is really a strange issue. I noticed that you have checked “Dial-in” tab of this problematic user properties
in ADUC. Just a confirmation, did you mean that “Allow access” option was checked under Network Access Permission? Or anything I misunderstand?
On current situation, please view the problematic account properties on Dashboard and navigate to
Anywhere Access tab, and please uncheck “Allow Virtual Private Network (VPN)” option and click Apply button. Then please re-check
“Allow Virtual Private Network (VPN)” option and apply again. Any difference?
By the way, did you check the event logs if find any related event or error?
If anything I misunderstand or any update, please don’t hesitate to let me know.
Hope this helps.
Best regards,
Justin Gu

Android MS RDP - RPC Error: Your connection was denied because of a Resource Access Policy (TS_RAP). Please contact your server administrator. (2147965402).

I love iTap Mobile. Paid for the app. Sorry to see them discontinue it, but now I know why. Microsoft bought them out! But even though free, I am getting an error: RPC Error: Your connection was denied because of a Resource Access
Policy (TS_RAP). Please contact your server administrator. (2147965402). I worked with iTap to fix this so I guess they sold Microsoft their older buggy code... Microsoft, please fix!
PS: This is the Android version. Mac and iOS are both okay.
EDIT: After an update a few months ago, iOS is no longer working. Not sure if the problem is related to the Android MSRDP issue.
UPDATE - Relevant posts (need Android RDP software engineer to fix):
Event Viewer Log when using Android client:
The user
"DOMAIN\testuser", on client computer "10.x.x.x", met connection authorization policy requirements and was therefore authorized to access the RD Gateway server. The following authentication method was used: "NTLM". (This
is most likely for logging into RD Web - icons shows up).
The
user "DOMAIN\testuser", on client computer "10.x.x.x", did not meet resource authorization policy requirements and was therefore not authorized to resource"localhost".
The following error occurred: "23002". (This is after clicking on any
of the icons).
I
think the Android MS RDP client is providing the incorrect resource. It shouldn't be "localhost".
It should be the RD Connection Broker's hostname, I believe.
Here's what it should look like (connected using a Windows PC going
through the RD Web portal via Internet Explorer):
The user "DOMAIN\testuser", on client computer "10.x.x.x", met connection
authorization policy requirements and was therefore authorized to access the RD Gateway server. The following authentication method was used: "NTLM".
The user "DOMAIN\testuser", on client computer "10.x.x.x", met resource
authorization policy requirements and was therefore authorized to connect to resource "rdsfarm.domain.com".
The user "DOMAIN\testuser", on client computer "10.x.x.x", connected
to resource "rdsfarm.domain.com".
Stephan,
Do you have any way to contact the software engineer who worked on the Android version of the RDP client? Please
have them read this thread. They need to fix the hard coded "localhost" resource to be a variable (namely whatever the user put in for the server).
This is why the MS RDP app is failing in situations where the FQDN for the RD Gateway and Connection Broker uses
the same host name.
Again, this is not a configuration problem on our end as it works as intended with the native Windows RDP client
as well as the Mac and iOS version of the mobile RDP client (all based on iTap Mobile's RDP app).
This is a problem specific to the Android RDP app.
PS: No matter how hard I try, the WYSIWYG editor is not very WYSIWYG at all, and so everything here looks messed up even though it looked right when I posted it (it is deleting new blank lines I'm inserting to make it spaced out and easier to read). See
below to read the post in context.

Thanks for the bumps, everyone. I haven't check this thread in a while because I basically gave up on Microsoft's ability to respond. Unlike paid apps, there's no number to call or ticket to open when an app like this malfunctions.
Just to give you an update, iOS users started having issues connecting a few months ago. I don't remember what version started this. I'm not sure if it's the same problem.
Also, the newest version now gives a slightly different error message: RpcOverHttpEndpointException: 2, Your connection was denied because of a Resource Access Policy (TS_RAP). Please contact your server administrator.
For Android users, I am starting to recommend Xtralogic Remote Desktop Client. It's a paid app, but it works great. I don't know of any alternative for iOS.
MSRDP for Mac OSX (was also an iTap application) continues to work throughout the many updates.
We need a software engineer from MS to read my first post. All the information that will point to a fix is there. I strongly believe someone hardcoded the string "localhost" instead of using a variable to point to the FQDN of the rdsfarm
name.
Here's that info again (copied/pasted). It doesn't take an engineer to understand the issue. If you know how to decipher Event Logs, you can see where the problem is.
Event
Viewer Log when using Android client:
The
user "DOMAIN\testuser", on client computer "10.x.x.x", met connection authorization policy requirements and was therefore authorized to access the RD Gateway server. The following authentication method was used: "NTLM". (This
is most likely for logging into RD Web - icons shows up).
The
user "DOMAIN\testuser", on client computer "10.x.x.x", did not meet resource authorization policy requirements and was therefore not authorized to resource"localhost".
The following error occurred: "23002". (This
is after clicking on any of the icons).
I
think the Android MS RDP client is providing the incorrect resource. It shouldn't be "localhost".
It should be the RD Connection Broker's hostname, I believe.
Here's
what it should look like (connected using a Windows PC going through the RD Web portal via Internet Explorer):
The user "DOMAIN\testuser", on client computer "10.x.x.x",
met connection authorization policy requirements and was therefore authorized to access the RD Gateway server. The following authentication method was used: "NTLM".
The user "DOMAIN\testuser", on client computer "10.x.x.x",
met resource authorization policy requirements and was therefore authorized to connect to resource "rdsfarm.domain.com".
The user "DOMAIN\testuser", on client computer "10.x.x.x",
connected to resource "rdsfarm.domain.com".

RemoteApps Error "Your connection was denied because of a Network Access Policy (TS_NAP). Please contact your server administrator."

Hello All,
Good day. May I ask if anyone experienced this error when trying to access remoteapps in Azure? We are using IaaS and set-up RDS using Windows 2012 R2 but we are getting an error below.
"Your connection was denied because of a Network Access Policy (TS_NAP). Please contact your server administrator.
Various roles and services (Broker, Session Host, RD Gateway and Web Access are installed on each VMs).
Please advise.
Thanks,
Glenn

Hi Glen;
Looks like the set up was not done correctly. Please follow the guidelines given on this
blog by Keith Mayer.
Regards;
Prasant

SQL Service Broker 2012: the connection was closed by the remote end, or an error occurred while receiving data: '64(The specified network name is no longer available.)'

Anyone can help with the below issue please? Much appreciated.
We have about 2k+ messages in sys.transmission_queue
Telnet to the ports 4022 is working fine.
Network connectivity has been ruled out.
The firewalls are OFF.
We also explicitly provided the permissions to the service account on Server A and Server B to the Service broker end points.
GRANT
CONNECT ON
ENDPOINT <broker> <domain\serviceaccount>
Currently for troubleshooting purposes, the DR node is also out of the Availability Group, which means that we right now have only one replica the server is now a traditional cluster.
Important thing to note is when a SQL Server service is restarted, all the messages in the sys.transmission queue is cleared immediately. After about 30-40 minutes, the errors are continued to be seen with the below
The
connection was
closed by the
remote end,
or an
error occurred while
receiving data:
'64(The specified network name is no longer available.)'

We were able to narrow down the issue to an irrelevant IP coming into play during the data transfer. We tried ssbdiagnose runtime and found this error:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>SSBDIAGNOSE -E RUNTIME -ID 54F03D35-1A94-48D2-8144-5A9D24B24520 Connect to -S <SourceServer> -d <SourceDB> Connect To -S <DestinationServer> -d <DestinationDB>
Microsoft SQL Server 11.0.2100.60
Service Broker Diagnostic Utility
An internal exception occurred: Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding.
P 29830 Could not find the connection to the SQL Server that
corresponds to the routing address tcp://XX.XXX.XXX.199:4022. Ensure the tool is connected to this server to allow investigation of runtime events
The IP that corresponds to routing address is no where configured within the SSB. We are yet unsure why this IP is being referred despite not being configured anywhere. We identified that this IP belongs to one of nodes other SQL Server cluster, which has
no direct relation to the source server. We failed over that irrelevant SQL Server cluster and made another node active and to our surprise, the data from sys.transmission_queue started flowing. Even today we are able to reproduce the issue, if we bring
back this node [XX.XXX.XXX.199] as active. Since, its a high business activity period, we are not investigating further until we get an approved downtime to find the root cause of it.
When we get a approved downtime, we will bring the node [XX.XXX.XXX.199] as active and we will be running Network Monitor, Process Monitor and the SSB Diagnose all in parallel to capture the process/program that is accessing the irrelevant IP.
Once, we are able to nail down the root cause, I will share more information.

I am having trouble transferring files from an old MacBook (2007) to a MacBook Air over a wireless network. The connection was interrupted and the time was over 24 hours. Is there a better way to do this? I'm using Migration assistant.

I am having trouble transferring files from an old MacBook (2007) to a MacBook Air over a wireless network. The connection was interrupted and the time was over 24 hours. Is there a better way to do this? I'm using Migration assistant. The lack of an ethernet port on MacBook air does not help.

William ..
Alternative data transfer methods suggested here > OS X: How to migrate data from another Mac using Mavericks

Opening attachments gives the error : "The connection was reset. The connection to the server was reset

Opening attachments gives the error : "The connection was reset. The connection to the server was reset. I tried clearing cookies and cache, but it doesnot work. 8 out of 10 times this is happenning. It's reproducible, and happening only after the latest update.

A possible cause is security software (firewall,anti-virus) that blocks or restricts Firefox or the plugin-container process without informing you, possibly after detecting changes (update) to the Firefox program.
Remove all rules for Firefox and the plugin-container from the permissions list in the firewall and let your firewall ask again for permission to get full unrestricted access to internet for Firefox and the plugin-container process and the updater process.
See:
*https://support.mozilla.org/kb/Server+not+found
*https://support.mozilla.org/kb/Firewalls
You can also try to reset (power off/on) the router.

I am playing in Pogo and cannot open the games even though the homepage and others will open. The message is THE CONNECTION WAS RESET WHILE THE PAGE WAS LOADING. How do I fix this???

I am playing in Pogo and cannot open the games even though the homepage and others will open. The message is THE CONNECTION WAS RESET WHILE THE PAGE WAS LOADING.
All my friends are playing and it seems I am the only one have this problem.

The "The connection was reset" error message can be caused by a bug fix for the BEAST (Browser Exploit Against SSL/TLS) attack that the server doesn't handle.
*[[/questions/918127]]
*[[/questions/918028]]

On opening I get message "The connection was reset. The connection to the server was reset while the page was loading" ??

On startup of Mozilla I recieve a message saying "The connection was reset ".
The connection to the server was reset while the page was loading.
Try again? After hitting the try again button it works.
== This happened ==
Every time Firefox opened
== After loading Firefox

I can connect http://www.bbc.co.uk/ & you may be interested in http://www.bbc.co.uk/iplayer/diagnostics
Is your problem with streaming audio broadcasts to and are you outside the UK ?
If so you may have fallen prey to the BBC's Content Distribution Network which often seems to produce problems they keep re-issuing advice such as:
*''Why am I having problems listening to BBC radio outside the UK, such as experiencing poor sound quality or the station is not working?25 May 2011 20:28'' [http://iplayerhelp.external.bbc.co.uk/help/outside_the_uk/radio_problems_international/ <-- this ]

The connection was reset whilst the page was loading

For the last 4 days i've been unable to connect to IGN ever since their server went down for about 5 minutes. I keep getting "The connection was reset whilst the page was loading."
I've cleared my recent history, cookies and even rebooted my computer and modem. I don't know what else to do in order to get IGN to work again, I know it isn't down... just no way it would be down 4+ days even if it was currently down as of typing (which it isn't). What else can I do in order to get it working again? This also happens on all browsers, not just Firefox.
Thanks

The site is live.
In Firefox '''Tools''' ('''Alt''' + '''T''') > '''Options''' > '''Advanced''' > '''Network''' > '''Settings''', please try selecting '''No Proxy''', if anything else is selected.
Also, check if you can do a '''tracert ign.com''' in a command window (Windows key + '''R''', type '''cmd''' and '''OK'''). If there are errors the ISP may be blocking the site.
Please also check your current IP address:
http://ip-blacklist.e-dns.org/
http://whatismyipaddress.com/blacklist-check
(you may have automatically inherited a bad address inadvertently)

I tried to update the App that I purchased but the message told me that my Apple account is not valid for use outside of US and I must switch back to US store to able to do it. How can I switch the account from foreign countries back to US?

I tried to update the App that I purchased but the message told me that my Apple account is not valid for use outside of US and I must switch back to US store to able to do it. How can I switch the account from foreign countries back to US?

On your phone (from http://support.apple.com/kb/ht1311):
Change your iTunes Store country
Sign in to the account for the iTunes Store region you'd like to use. Tap Settings > iTunes & App Stores > Apple ID: > View Apple ID > Country/Region.
Follow the onscreen process to change your region, agree to the terms and conditions for the region if necessary, and then change your billing information.

Can't enroll device for user and this user account is not authorized to use Windows Intune.

Hello,
We have SCCM 2012 R2 inegrated with intune via an intune subscription. When I enroll a device with my admin account there are no problems, but when I want to add it with another user account which is a member of the Intune users collection, it can't be enrolled.
When I tested on https://portal.manage.microsoft.com with the credentials of the user I couldn't connect and received the following error: This user account is not authorized to use Windows Intune.
Do I have to do anything in the https://accounts.manage.microsoft.com as there is a checkbox saying Windows Intune. this is unchecked now for all the users even my own account on which I'm able to enroll a device.
Or is this a license problem? I know configuration Manager uses licenses for Intune but where can we track how many licenses are used and how many available? Is there some kind of report available?
I hope someone can help me
Kind regards,
Robben

I added them yesterday and this morning I was still not able to enroll a device with the added user his credentials.
The UPN is correct. Maybe I need to force the DirSync then? Or will one day of waiting be enough normally?
I can see the user in the intune management portal. Does this means it has been synced?
Another thing I noticed is the cloudusersync.log doesn't show them being added? What I was thinking is I first used the all Users collection in the subscription and afterwards I changed it to a specific collection with only the test users. Could it be that
they all synced already and the log doesn't show them anymore?
A warning in this log shows this also:
WARNING: Failed to get lsu url. default release one will be used. exception = System.NullReferenceException: Object reference not set to an instance of an object.~~   at Microsoft.ConfigurationManager.DmpConnector.UserSync.CloudUserUpload..ctor()
SMS_CLOUD_USERSYNC   23/04/2014 15:02:18   7684 (0x1E04)
I don't know if that has anything to do with this?
this is an extract of that log:
CCloudUserSync::Process - User sync processing thread is now stopping.   SMS_CLOUD_USERSYNC   23/04/2014 14:59:42   8144 (0x1FD0)
SMS_EXECUTIVE started SMS_CLOUD_USERSYNC as thread ID 7684 (0x1E04).   SMS_CLOUD_USERSYNC   23/04/2014 15:02:15   7572 (0x1D94)
CCloudUserSync::Process - User sync processing has started.   SMS_CLOUD_USERSYNC   23/04/2014 15:02:15   7684 (0x1E04)
Starting user sync ...   SMS_CLOUD_USERSYNC   23/04/2014 15:02:15   7684 (0x1E04)
WARNING: Failed to get lsu url. default release one will be used. exception = System.NullReferenceException: Object reference not set to an instance of an object.~~   at Microsoft.ConfigurationManager.DmpConnector.UserSync.CloudUserUpload..ctor()
SMS_CLOUD_USERSYNC   23/04/2014 15:02:18   7684 (0x1E04)
Starting user delta sync, raise failure status messages = True   SMS_CLOUD_USERSYNC   23/04/2014 15:02:18   7684 (0x1E04)
Total received users from SCCM to be removed from cloud = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:02:19   7684 (0x1E04)
Successfully removed users from cloud 0   SMS_CLOUD_USERSYNC   23/04/2014 15:02:19   7684 (0x1E04)
Total received users to add from SCCM = 0, Total Successfully added users to Cloud = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:02:19   7684 (0x1E04)
UserDeltaSync:- Users Added = 0, Users Removed = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:02:19   7684 (0x1E04)
Starting user delta sync, raise failure status messages = True   SMS_CLOUD_USERSYNC   23/04/2014 15:07:19   7684 (0x1E04)
Total received users from SCCM to be removed from cloud = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:07:19   7684 (0x1E04)
Successfully removed users from cloud 0   SMS_CLOUD_USERSYNC   23/04/2014 15:07:19   7684 (0x1E04)
Total received users to add from SCCM = 0, Total Successfully added users to Cloud = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:07:19   7684 (0x1E04)
UserDeltaSync:- Users Added = 0, Users Removed = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:07:19   7684 (0x1E04)
Starting user delta sync, raise failure status messages = True   SMS_CLOUD_USERSYNC   23/04/2014 15:12:19   7684 (0x1E04)
Total received users from SCCM to be removed from cloud = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:12:19   7684 (0x1E04)
Successfully removed users from cloud 0   SMS_CLOUD_USERSYNC   23/04/2014 15:12:19   7684 (0x1E04)
Total received users to add from SCCM = 0, Total Successfully added users to Cloud = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:12:19   7684 (0x1E04)
UserDeltaSync:- Users Added = 0, Users Removed = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:12:19   7684 (0x1E04)
Starting user delta sync, raise failure status messages = True   SMS_CLOUD_USERSYNC   23/04/2014 15:17:19   7684 (0x1E04)
Total received users from SCCM to be removed from cloud = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:17:19   7684 (0x1E04)
Successfully removed users from cloud 0   SMS_CLOUD_USERSYNC   23/04/2014 15:17:19   7684 (0x1E04)
Total received users to add from SCCM = 0, Total Successfully added users to Cloud = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:17:19   7684 (0x1E04)
UserDeltaSync:- Users Added = 0, Users Removed = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:17:19   7684 (0x1E04)
Starting user delta sync, raise failure status messages = True   SMS_CLOUD_USERSYNC   23/04/2014 15:22:19   7684 (0x1E04)
Total received users from SCCM to be removed from cloud = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:22:19   7684 (0x1E04)
Successfully removed users from cloud 0   SMS_CLOUD_USERSYNC   23/04/2014 15:22:19   7684 (0x1E04)
Total received users to add from SCCM = 0, Total Successfully added users to Cloud = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:22:20   7684 (0x1E04)
UserDeltaSync:- Users Added = 0, Users Removed = 0   SMS_CLOUD_USERSYNC   23/04/2014 15:22:20   7684 (0x1E04)
kind regards,
Robben

Whenever I use a search engine, I keep getting the error message "The connection was reset while the page was loading".

I am able to access the internet, but none of the search engines like Google, Yahoo or Bing will work. the page will not load. I get the error message:
The connection to the server was reset while the page was loading.
* The site could be temporarily unavailable or too busy. Try again in a few moments.
* If you are unable to load any pages, check your computer's network connection.
* If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the Web.

Your plugins list shows two Flash plugins and other outdated plugin(s) with known security and stability risks.
# Shockwave Flash 10.0 r45
# Shockwave Flash 10.1 r53
# Adobe Shockwave for Director Netscape plug-in, version 11.0
# Next Generation Java Plug-in 1.6.0_19 for Mozilla browsers
Flash Player uninstall: http://www.adobe.com/go/tn_14157 (this will remove the Firefox Flash plugin and the ActiveX control for IE)
Update the [[Flash]] and [[Shockwave|Shockwave for Director]] plugin to the latest version.
*http://www.adobe.com/software/flash/about/
*http://www.adobe.com/shockwave/welcome/
*http://www.adobe.com/downloads/
Update the [[Java]] plugin to the latest version.
*http://java.sun.com/javase/downloads/index.jsp (Java Platform: Download JRE)
Do a malware check with a few malware scan programs.<br />
You need to use all programs because each detects different malware.<br />
Make sure that you update each program to get the latest version of the database.
*http://www.malwarebytes.org/mbam.php - Malwarebytes' Anti-Malware
*http://www.superantispyware.com/ - SuperAntispyware
*http://www.safer-networking.org/en/index.html - Spybot Search & Destroy
*http://www.lavasoft.com/products/ad_aware_free.php - Ad-Aware Free
*http://www.microsoft.com/windows/products/winfamily/defender/default.mspx - Windows Defender: Home Page
See also "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked and [[Searches are redirected to another site]]

I get "The connection was reset" at times. I want this fixed for a future version of Firefox.

I am getting "The connection was reset" on certain sites, like totaljerkface.com at times. I really hope Mozilla employees get rid of this message and every website loads properly. I have never gotten this error on major websites like YouTube and Google. Can someone on this forum report this to Mozilla staff? Thanks.

Can someone help me with this report? I hate getting this error.

Access to my Office 365 third-party app for external user : "a User account is not registered for the account"

In my third-party web application of Office 365, I want to have access to the contacts, events and emails of all the users from the organizations who installed my app. The thing is I don't want that all these users have to grant me access, I just want one
admin of the org to grant access for my app and then be able to retrieve the data I need for all the users.
To test for one organization, I logged in as the admin and proceed to the Oauth2 authentication to retrieve the access token and in the first request (the GET one to retrieve an authorization code) i add the parameter
prompt=admin_consent.
With this access token, I can access the data (emails, contact, event) of the admin
for instance for the contacts
uri: https://outlook.office365.com/ews/odata/Users(adminemail)/Contacts
but not the data of the other users of this org with this uri
uri: https://outlook.office365.com/ews/odata/Users(useremail)/Contacts
The only thing I can do is retrieve an access token for each user but it supposed that each user has to authorize the access to the app but it's very cumbersome. So, i don't see what enables the parameter prompt=admin_consent and how to use it. Does anybody
know what it does?
And my question is: how can I do to access the data of all the users of one organization when the access has been granted by one admin?
Thank you!

This was answered on StackOverflow by Dushyant Gill. http://stackoverflow.com/questions/25316175/access-to-my-office-365-third-party-app-for-external-user-a-user-account-is-n/25316678#25316678
You are sending the OAuth request to a tenant specific endpoint of Azure AD. Note the {key_provided} part of your Url - that part represents the tenantid or a registered domain name of an Azure AD tenant. Azure AD throws this error is the user signing in
is not a user in that tenant.
Multi-tenant applications like yours have two options:
Perform home realm discovery yourself and send the SSO request to the correct tenant-specific endpoint of Azure AD: when a new Azure AD organization signs-up for your application, record its tenant ID, and registered domain names. On your login page, ask
the user for their email and try to discover what Org they belong to using the suffix the email.
Use the common endpoint of Azure AD. Instead of the {key_provided} part of the URL, use 'common'. In this case Azure AD will determine the user's tenant and sign-in the user. The token that your application will receive will still be from the user's tenant
(iss claim).
2 is more convenient for apps. However #1 has an advantage when the user's Organization has customized their sign-in page with the company logo etc - in the case of #1 the user will directly be taken to the customized and familiar sign-in page.
I recommend a combination of the two: try determining the user's organization and sending them to the tenant specific SSO endpoint. If you're not able to - send them to the common endpoint.

The connection was denied because the user account is not authorized for remote login

Similar Messages

Maybe you are looking for