Merge pull request #5760 from SkylineCommunications/dataminer.services-Microsoft-account-approval

dataminer.services Microsoft account approval

Author: MariekeGO

dataminer/dataminer_services/About_dataminer_services/Logging_on_to_dataminer_services.md

@@ -22,11 +22,50 @@ When you access <https://dataminer.services>, you will have the following option
 - If your corporate email address is linked to a Microsoft (personal or work), Google, Amazon, or LinkedIn account, you can authenticate yourself via one of those identity providers. This option is to be preferred, as it will allow you to use an existing account rather than a new, dedicated one.
 
   > [!NOTE]
-  > In case you are using the Microsoft login and get an error that says you need admin approval, you can find the steps that your system administrator needs to take to resolve this on [this instructions page](https://dataminer.services/make-an-account/access_dcp.html).
+  > In case you are using the Microsoft login and get an error that says you need admin approval, below you can find [how your system administrator can resolve this](#having-trouble-signing-in-with-your-microsoft-account).
 
 - If you cannot use an existing account, you can choose to create a dedicated dataminer.services account via the *Sign Up* option at the bottom. You will then be invited to enter your corporate email address and a password of your choice.
 
 > [!NOTE]
 >
 > - Not all people who register with a corporate email address associated with your organization will automatically be granted access to all information that is exclusively available to your organization. This will only be the case for users who already had an account on the legacy dcp.skyline.be platform, i.e users who were already linked to your organization.
 > - New people from your organization will have to create a user account on dataminer.services using their corporate email address (see above), which will then have to be linked to your organization. Currently, linking email addresses to organizations can only be done by Skyline staff on request. At a later time, we intend to provide you with an option to appoint an administrator in your organization, who will then be allowed to set up new dataminer.services accounts for your organization.
+
+### Having trouble signing in with your Microsoft account?
+
+When you want to log in using your existing corporate Microsoft account, the following notification may be shown:
+
+![Need admin approval](~/dataminer/images/dataminerservices_need_admin_approval.png)
+
+If you see this, you should contact your IT department, so they can approve the access to the required resources. They will only have to give consent once. When this is done, this message will no longer be shown.
+
+There are two options for your IT department to give consent:
+
+- They can go to dataminer.services and go through the normal process of registering an account.
+- They can use use the following link to directly give consent to our application:
+
+  `https://login.microsoftonline.com/{tenant-id}/adminconsent?client_id=2e25a456-a261-44cf-beb8-06da7f5199f5`
+
+  In this link, `{tenant-id}` is your organization's tenant ID or any verified domain name.
+
+In both cases, it is important to select the checkbox *Consent on behalf of your organization*. Selecting this also automatically allows access for regular users in the organization.
+
+![Request for permissions](~/dataminer/images/dataminerservices_consent_on_behalf_of_organization.png)
+
+If the window shown above is not displayed, make sure an account is used that has the **Global Administrator** role in Azure.
+
+These are the only things to which access is needed:
+
+- `openid - https://graph.microsoft.com/openid`
+
+  Allows users to sign in to the app with their work or school accounts, and allows the app to see basic user profile information.
+
+- `offline_access - https://graph.microsoft.com/offline_access`
+
+  Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions.
+
+> [!TIP]
+> For more information, refer to the following Microsoft documentation pages:
+>
+> - [Consent experience for applications in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/application-consent-experience#common-consent-scenarios)
+> - [Grant tenant-wide admin consent to an application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal)