The user or administrator has not consented to use the application - Send an interactive authorization request for this user and resource

An admin must consent to the permissions. You should make an authorization request to Azure AD that includes the parameter prompt=admin_consent.

As in the documentation here, the prompt parameter can have 3 values: login, consent, or admin_consent.

So, you should go to a URL such as https://login.microsoftonline.com/tenant-id/oauth2/authorize?client_id=app-client-id&redirect_uri=encoded-reply-url&response_type=code&prompt=admin_consent.

Replace tenant-id with your Azure AD tenant id/domain name, or common if your app is multi-tenant. Replace app-client-id with your app's client id. Replace encoded-reply-url with a URL-encoded reply URL of your app.

An easier way of constructing the URL you need is to go through authentication and just grab the URL in the address bar when you hit Azure AD. Then just add &prompt=admin_consent to the URL.

EDIT: With the newest update to the Azure Portal came the ability to grant permissions from the portal directly.

If you go to Azure Active Directory in the new portal, find your app registration there and click Grant Permissions under the Required permissions blade.

As per Oauth V2.0. you do not need to resend the Scope parameter in the Token API to generate Refresh/access tokens. You don't need to manually specify scopes In the azure portal as well, it will get listed automatically.

It is inherited from your auth_code, you can remove the scope and request, it should work and also once you decode the access_token, you should be able to see the same scopes, you requested during authorization

I was getting this error in a native application using ADAL. I had given all of the correct permissions, but had already received a token from a previous signin. My issue was that the previous token was stale and did not contain the updated claims. For me, the solution was to use PromptBehavior.RefreshSession as per the code below.

   AuthenticationResult result = await authenticationContext.AcquireTokenAsync(resourceId, clientId, redirectURI, new PlatformParameters(PromptBehavior.RefreshSession, false));

As per MSDN, PromptBehavior.RefreshSession "Re-authorizes (through displaying webview) the resource usage, making sure that the resulting access token contains updated claims. If user logon cookies are available, the user will not be asked for credentials again and the logon dialog will dismiss automatically."