O365 Enterprise Apps - Anyone good at troubleshooting?

[Warwick_Tech]

So, we've turned off self app registration for obvious reasons and have been trundling along with an 'all or nothing' approach where we just grant Admin consent for whole school.

 

This has been working a treat, but realistically we need to start granularly dropping back these permissions as more and more apps get added, some only for staff, some only for students etc.

 

The issue is, I can only really get SSO to work if 'global admin' consent is enabled, otherwise any non admins cannot login, even if assigned the app in 'users and groups'

 

To make things stranger, even options like 'hide this app' don't seem to work as they can still see all the icons on their office waffle.

 

Does anyone have any good steps or best practice to tidy this up?