Need Admin Approval to Connect Outlook? Here's the Fix
Tried to connect Outlook and got stopped by a message about needing admin approval? Nothing is wrong with your account or your password. Your company has Microsoft 365 set to require an administrator’s sign-off before anyone connects a new app, and that setting is doing its job.
It takes one person one click to clear. Here is the whole thing in three steps.
- You send your admin a link.
- They open it and approve, once, for the whole company.
- You go back and connect your email.
Step 1: send this to your admin
The link is carlyassistant.com/admin-setup.
It is a public page, so your administrator does not need a Carly account to open it. Here is a message you can paste straight into an email or a Slack DM:
Hi, I’m trying to connect our Outlook to Carly AI and Microsoft is telling me it needs admin approval.
Could you open this page and approve it? https://carlyassistant.com/admin-setup
It lists every permission being requested, and the button takes you to Microsoft’s own consent screen to approve. It’s a one-time thing that covers the whole organization, so nobody else will get prompted later. It can be revoked any time from Entra ID.
Happy to send anything else you need for it. Thanks!
That is genuinely all you need to do. The rest of this page is for whoever picks that message up.
Step 2: if you’re the admin, here’s what you do
Four clicks, start to finish.
- Open carlyassistant.com/admin-setup. No account needed. The page lists every permission requested, in plain language, next to the Microsoft Graph scope behind it.
- Click Grant Admin Consent. This does not approve anything by itself. It hands you to Microsoft.
- Sign in with an account that can consent for the organization. More on which roles work below.
- Review the permissions Microsoft shows you and select Accept.
Done. Everyone in the tenant can now connect without being prompted individually.
What you’re approving
| Group | What it covers | Graph scopes |
|---|---|---|
| Calendar | Read and write events, including shared calendars | Calendars.ReadWrite, Calendars.ReadWrite.Shared |
| Online meetings | Create Teams links on events | OnlineMeetings.ReadWrite |
| Read, send, and manage email so replies can go out | Mail.Read, Mail.Send, Mail.ReadWrite | |
| Shared mailboxes | Mailboxes the user can already open | Mail.Read.Shared, Mail.ReadWrite.Shared, Mail.Send.Shared |
| Mailbox settings | Time zone, working hours, automatic replies | MailboxSettings.Read, MailboxSettings.ReadWrite |
| OneDrive files | Files attached or worked on | Files.ReadWrite.All |
| Contacts | Read, create, and update contacts | Contacts.ReadWrite |
| Microsoft Tasks | To Do and basic Planner tasks | Tasks.ReadWrite |
| Sign-in and profile | Name and email, staying connected | User.Read, offline_access, openid, profile, email |
These are delegated permissions. They apply on behalf of a signed-in user who has connected their own account, and never exceed what that person can already do. Approving removes the prompt; it does not touch the mailbox of anyone who never signs in and connects.
Which role you need
- Privileged Role Administrator consents to anything
- Cloud Application Administrator, Application Administrator, or AI Administrator consents to anything except Microsoft Graph app roles, which is enough here because these are delegated scopes
- A custom directory role carrying permission to grant these permissions
If you get “you do not have rights to do that,” you are signed in as something below this list.
If you’d rather not follow a link from an email
Fair. The same grant is in the portal once the app exists in your tenant, which it does as soon as someone has tried to connect:
- Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
- Go to Entra ID → Enterprise apps → All applications.
- Search for the application and select it.
- Open Permissions under Security.
- Review the requested permissions and select Grant admin consent.
Two things worth knowing. Consent and access are separate controls, so if you want only one team to have this, grant consent and then configure the app to require user assignment and assign that group. And if the app was partly approved before, granting tenant-wide consent can revoke permissions previously granted tenant-wide, though anything individual users granted for themselves is unaffected.
Then tell them it’s done
Send a one-liner back. The person waiting cannot see that you approved it, and they will keep hitting the same wall until they know to retry:
Approved. You should be able to connect now.
Step 3: back to you, connect your email
Once your admin says it’s approved:
- Go to carlyassistant.com/integrations.
- Find Outlook and click Connect.
- Sign in with your Microsoft 365 account.
- Approve access on the Microsoft screen. This time it goes through.
- Confirm the mailbox address that appears before moving on, so you know which account landed.
Then add the rest. Click Connect again for every additional mailbox or calendar you want reachable, choosing Use another account if Microsoft preselects the first login. Each account is authorized separately and every action reports which one it came from, so a personal address and a work address can both be connected without getting mixed up.
If you still see the approval message, wait a few minutes and retry, since consent takes a short while to propagate.
If your company has a request button instead
Some organizations turn on Microsoft’s admin consent workflow, which replaces the dead end with a box asking why you need the app. If you saw that box and submitted it, you have already done step 1. The request goes to whoever your company designated as a reviewer, and you get notified either way. Requests expire after a number of days your company sets, so if it goes quiet, send the link directly.
If you got a flat refusal with no way to ask, that workflow is switched off in your tenant, which is exactly why step 1 exists.
When it still doesn’t work
| What you’re seeing | What to do |
|---|---|
| Admin approved, still blocked | Wait a few minutes and retry; consent takes a moment to propagate |
| Admin says they lack rights | Send them the role list above; they need Application Administrator or higher |
| You’re a guest in a client’s tenant | Approval has to come from that tenant’s admin, not your own |
| Approved but the wrong mailbox connected | Disconnect, reconnect, and choose Use another account |
| Your company won’t approve third-party apps at all | Book a call and we’ll work through what your security team needs |
What you can do while you wait
Approval is rarely instant, so it helps to know what isn’t blocked by it.
Google accounts connect on their own. Gmail and Google Calendar authorize per user, so if you have a personal or Workspace Google account, connect it now and start there. The Microsoft approval only gates the Microsoft side.
Build the parts that don’t need Outlook. Booking pages and workflows over your other tools can be set up and tested while the request sits with IT. When consent lands, connect Outlook and what you already built starts covering it.
Free Zapier-style workflows; AI agents from $35/month.
Frequently asked questions
What does “Need admin approval” mean in Outlook?
Your Microsoft 365 organization requires an administrator to approve third-party apps before users connect them. It is a company policy setting, not a problem with your account, licence, or password.
How do I get admin approval?
Send whoever administers your Microsoft 365 the link carlyassistant.com/admin-setup. They open it, review the permissions, and approve on Microsoft’s own consent screen. There is a copy-paste message above you can send them.
How long does it take?
The approval itself is about a minute. How long it takes to reach the top of your IT team’s list is the real variable, which is why sending the permission list up front helps.
Does approving it give access to everyone’s email?
No. The permissions are delegated, so they apply only for a signed-in user who has connected their own account, and never exceed what that person can do themselves. Colleagues who never connect are untouched.
Can it be undone?
Yes, at any time from Microsoft Entra ID. Revoking consent ends the connection.
Can we approve it for just one team?
Yes. Grant consent, then configure the app to require user assignment and assign only the group that should have it.
What do I do after my admin approves?
Go back to the integrations page, click Connect on Outlook, sign in, and confirm the mailbox address that appears. Then repeat for any other accounts you want connected.
Related: Best AI email assistants for Outlook · Best AI assistants for Outlook Calendar · New Outlook vs classic Outlook · Multiple Outlook accounts with AI · Carly’s Outlook integration
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
