How can I programmatically set a connected app to have permitted users be "Admin approved users are pre-authorized"?

Question

Background: I am making a managed package and have a connected app that needs to have permitted users set to "Admin approved users are pre-authorized" for it to work correctly:

It is a terrible experience for admins installing my app to make them change this value (and this is typically the step that they get wrong). Does anyone know of a way to change this value programmatically...like in a post-install script? It would make it much better for the users.

---

What I have tried so far:

I tried changing the xml via instructions on https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_connectedapp.htm by adding <isAdminApproved>true</isAdminApproved> to the <oauthConfig> part of the .xml for my connected app, but the behavior of scratch orgs created that way was unchanged.

Answer 1

Thank you to identigral and daniel-ballinger for your helpful comments! With your help, I was able to figure it out.

Please see the post-install script snippet below (which leverages a tweaked version of apex-mdapi: https://github.com/financialforcedev/apex-mdapi/pull/242/commits) on how to switch it to "Admin Users are pre-authorized" and set some profiles.

    //gets the actual MetadataPort object and pulls the session id
    MetadataService.MetadataPort service = new MetadataService.MetadataPort();
    service.SessionHeader = new MetadataService.SessionHeader_element();
    service.SessionHeader.sessionId = UserInfo.getSessionId();

    //grabs the pre-existing connected app that I already created as part of my managed package
    MetadataService.ConnectedApp connectedApp = (MetadataService.ConnectedApp)service.readMetadata('ConnectedApp', new String[] {'My_Connected_App'}).getRecords()[0];

    //adds in the appropriate profileNames and sets isAdminApproved to be true
    connectedApp.profileName = new List<String>();
    connectedApp.profileName.add('System Administrator');
    connectedApp.profileName.add('Standard User');
    connectedApp.oauthConfig.isAdminApproved = true;

    //saves the updates
    List<MetadataService.SaveResult> results = service.updateMetadata(new MetadataService.Metadata[] {connectedApp});