How to Grant Admin Consent in Microsoft 365 (Entra ID)
Someone on your team hit “Need admin approval” connecting an app to Outlook, and now it’s on your desk. Granting admin consent takes about a minute. Here is the fastest route, three alternatives, and what to check before you click.
The quick answer: in the Microsoft Entra admin center, go to Entra ID → Enterprise apps → All applications, open the app, select Permissions under Security, review the list, and select Grant admin consent. You need to be at least a Cloud Application Administrator. Then tell the person who asked, because they won’t find out otherwise.
Which role you need
From Microsoft’s documentation:
| Role | Can grant |
|---|---|
| Privileged Role Administrator | Any permission, for any API |
| Cloud Application Administrator, Application Administrator, AI Administrator | Any permission except Microsoft Graph application permissions (app roles) |
| Custom directory role with permission-grant rights | The permissions that role covers |
Most apps that connect to a person’s Outlook, like AI assistants, scheduling tools and CRM plugins, request delegated permissions, so a Cloud Application Administrator is enough. If the app requests application permissions (it runs without a signed-in user and can reach every mailbox), you need a Privileged Role Administrator.
If the Grant admin consent button is greyed out or you get “you do not have rights,” you are signed in below these roles.
Before you click: check four things
Admin consent approves the app for everyone in the organization, so it’s worth thirty seconds.
- Delegated or application? Delegated permissions act only for a user who signs in, and never beyond what that user can already do. Application permissions act on their own across the whole tenant. On the consent screen, delegated descriptions usually end “on behalf of the signed-in user” and application ones “without a signed-in user.”
- Do the permissions match the job? An email assistant needs mail and calendar. It has no business asking to manage directory roles.
- Who published it? Check the publisher name and whether it’s verified, and watch for apps named to look like other apps.
- Can you get the list in writing? Most vendors publish an admin consent page listing every permission. Compare it against what Microsoft shows you.
If a permission doesn’t make sense, don’t approve yet. Ask the vendor.
Four ways to grant admin consent
1. From Enterprise apps (most common)
Use this when the app already exists in your tenant, which it does as soon as anyone has tried to sign in to it.
- Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
- Browse to Entra ID → Enterprise apps → All applications.
- Search for the app and select it.
- Select Permissions under Security.
- Review the permissions and select Grant admin consent.
- Microsoft opens its consent screen. Review it again and select Accept.
2. From the vendor’s consent link or the admin consent URL
Many vendors send you a link that goes straight to Microsoft’s approval screen. If you’d rather build it yourself, the format is:
https://login.microsoftonline.com/{organization}/adminconsent?client_id={client-id}Replace {organization} with your tenant ID or a verified domain (or organizations to use your own home tenant), and {client-id} with the app’s application ID from the vendor. This works even if nobody has signed in to the app yet.
3. From a pending request
If your company has the admin consent workflow switched on, the employee’s request is already waiting for you.
- Sign in as at least a Cloud Application Administrator who is a designated reviewer.
- Browse to Entra ID → Enterprise apps, and under Activity select Admin consent requests.
- Open the My Pending tab and select the app.
- Check Requested by to see who asked and why, then select Review permissions and consent.
- Approve by granting consent. Every requester gets an email saying it’s approved.
You can also Deny (they can ask again) or Block (future requests for that app are stopped). Both require a written justification that goes to the requester.
4. With Microsoft Graph PowerShell
For scripted rollouts. Delegated grants use New-MgOauth2PermissionGrant with ConsentType = "AllPrincipals", signed in as at least a Cloud Application Administrator. Microsoft’s warning is worth repeating: grants made this way skip the review screen and take effect immediately, so check the scope list twice. The full example is in Microsoft’s docs.
Approve it for one team only
Consent and access are separate. After granting consent, you can still restrict who uses the app:
- In Enterprise apps, open the app and select Properties.
- Set Assignment required? to Yes and save.
- Open Users and groups and add the people or group who should have it.
Everyone else is blocked from signing in to it, even though consent is granted.
Let employees ask you properly next time
If your people are getting the dead-end “Need admin approval” screen, the request feature is off. Turning it on gives them an Approval required screen with a request box, and sends you an email instead of a Teams message with no details.
- Sign in to the Microsoft Entra admin center as a Global Administrator.
- Browse to Entra ID → Enterprise apps → Consent and permissions → Admin consent settings.
- Set Users can request admin consent to apps they are unable to consent to to Yes.
- Choose reviewers, turn on email notifications and reminders, and set how many days a request stays open.
- Select Save. It can take up to an hour to switch on.
Reviewers still need a role that can grant consent. Being on the reviewer list doesn’t give them one.
How to revoke it later
- Go to Entra ID → Enterprise apps → All applications and open the app.
- Select Permissions, then the Admin consent tab.
- Select the … next to a permission and choose Revoke permission.
Permissions individual users granted for themselves appear under User consent and can only be revoked with PowerShell or Microsoft Graph.
When it still doesn’t work
| What you’re seeing | Why | Fix |
|---|---|---|
| Employee still sees the approval screen | Consent hasn’t propagated, or the app now asks for a permission you didn’t approve | Wait a few minutes; if it persists, check Permissions for anything missing |
| App isn’t in Enterprise apps | Nobody in your tenant has signed in to it yet | Use the vendor’s consent link or the admin consent URL |
| Button greyed out | Your role can’t grant these permissions | Use an account with one of the roles above |
| ”App is considered risky” | Microsoft flagged it, often because the publisher isn’t verified | Only admins can approve it; review the app carefully first |
| Some previously approved permissions disappeared | Granting tenant-wide consent can replace earlier tenant-wide grants | Re-grant everything the app lists |
Approving Carly
If the request is for Carly, the admin page is carlyassistant.com/admin-setup. It lists every Microsoft Graph permission in plain language, covering mail, calendar, contacts, tasks and OneDrive, and its button opens Microsoft’s consent screen.
The screen says “organization-wide consent,” which is where most admins pause. Here’s what it does and doesn’t mean:
- You’re approving the integration, not connecting anyone. No mailbox is touched until that person signs in and connects their own account.
- Connecting Emily doesn’t reach Josh’s inbox. Carly sees what Emily can already see. If she has no access to Josh’s mailbox, neither does Carly, and Josh isn’t connected unless he connects himself.
- Shared mailboxes and calendars follow existing permissions. Carly works with the ones the connected user can already open and gives nobody access to anything new.
- Every permission is delegated. Carly acts on behalf of a connected user, within what you approved and what that user can already do. It has no app-only access of its own in your tenant.
- You can limit it to a few people. Grant consent, then require user assignment and add only those users or groups.
- You can take it back. Revoke the permissions in Microsoft Entra whenever you like.
The employee-side walkthrough is Need admin approval to connect Outlook?
Frequently asked questions
How do I grant admin consent in Microsoft 365?
In the Microsoft Entra admin center, go to Entra ID, Enterprise apps, All applications, open the app, select Permissions under Security, and select Grant admin consent. You need at least the Cloud Application Administrator role.
Who can grant admin consent?
A Privileged Role Administrator for any permission. A Cloud Application Administrator, Application Administrator or AI Administrator for anything except Microsoft Graph application permissions. A custom role with permission-grant rights for what it covers.
What is the admin consent URL?
https://login.microsoftonline.com/{organization}/adminconsent?client_id={client-id}, with your tenant ID or verified domain and the app’s application ID. It opens Microsoft’s consent screen directly.
Does admin consent give the app access to every mailbox?
Only if it requests application permissions. With delegated permissions, the app acts only for users who sign in and connect it, and only within what each user can already access.
Can I grant admin consent for just one group?
Consent is tenant-wide, but access isn’t. Grant consent, then set Assignment required to Yes in the app’s Properties and add only that group under Users and groups.
How do I turn on admin consent requests?
As a Global Administrator, go to Entra ID, Enterprise apps, Consent and permissions, Admin consent settings, set users can request admin consent to Yes, choose reviewers, and save.
How do I undo admin consent?
Open the app in Enterprise apps, select Permissions, go to the Admin consent tab, and revoke each permission from its menu.
Related: Need admin approval in Microsoft 365? · Need admin approval to connect Outlook? · Best AI email assistants for Outlook · Carly’s Outlook integration
Want someone to handle the setup?
Book a short call. We'll walk your IT admin through the Microsoft approval, connect your email and calendar, and have your AI assistant working on them.
Book a call
