Suppose, we have just registered an application in Azure Active Directory and trying to acquire the token and get the below error

Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: ‘AADSTS65001: The user or administrator has not consented to use the application with ID ‘b2c5028d-57e6-4df7-9940-828e6914948b’ named ‘MyApp’. Send an interactive authorization request for this user and resource.

This is because admin consent is required before the application can be used. This could be granted by global administrator.

One of the ways to do so is through the URL with the specific format as shown below

https://login.microsoftonline.com/[tenantid]/oauth2/authorize?client_id=[appId]&response_type=code&redirect_uri=[redirctURL]&resource=[resourceURL]&prompt=admin_consent

Pasting this URL in the browser will prompt for the credential, login will global administrator and we will be presented with the following consent box

Clicking on Accept will grant the required permission to the application registered.

Hope it helps..

We can use RetrievePrincipalAccess function in Web API to get the access rights of either a user or team on a specific record.

The sample code:

var req = new XMLHttpRequest();

req.open("GET", Xrm.Page.context.getClientUrl() + "/api/data/v9.1/systemusers(D38F5B76-C22E-4256-AF90-CFD14B6589BF)"+
"/Microsoft.Dynamics.CRM.RetrievePrincipalAccess(Target =@Target)?"+ 
"@Target={ 'accountid': '8CB09F67-EB90-E811-A963-000D3AD1CBD6', '@odata.type': 'Microsoft.Dynamics.CRM.account' } ", false);

req.setRequestHeader("OData-MaxVersion", "4.0");
req.setRequestHeader("OData-Version", "4.0");
req.setRequestHeader("Accept", "application/json");
req.setRequestHeader("Content-Type", "application/json; charset=utf-8");
req.onreadystatechange = function () {
if (this.readyState === 4) {
req.onreadystatechange = null;
if (this.status === 200) { 
var results = JSON.parse(this.response);
} else { 
Xrm.Utility.alertDialog(this.statusText);
}
}
};
req.send();

Result:

Hope it helps..