Approve an app's access in Microsoft 365

When an app connects a Microsoft 365 mailbox, Microsoft shows a screen listing what the app asks to do, and someone has to approve it. Whether the person connecting can approve it themselves depends on your organisation's settings. When they cannot, they see a message such as "Need admin approval" and the app waits until an administrator acts. This article covers the three ways to approve, and how to review and remove an approval afterwards.

The steps below are Microsoft's, from its own pages as they read on 23 October 2026, and Microsoft changes its admin centres often. The guide for each app says which permissions that vendor asks for.

Read what the app asks for

Approving gives the app's publisher access to your data, so read the permissions before you approve them. Microsoft says: "Granting admin consent on behalf of an organization is a sensitive operation, potentially allowing the application's publisher access to significant portions of your organization's data". Microsoft: grant tenant-wide admin consent to an application

Two kinds of permission matter for sending mail:

• A delegated permission lets the app act as the person who signed in, so it can only send as that person. Most CRMs connect each person's own mailbox this way.
• An application permission lets the app act without anyone signed in. Microsoft describes Mail.Send as an application permission as: "Allows the app to send mail as any user without a signed-in user." Limit it to the mailboxes the app needs. Limit which mailboxes an app can send as

Way 1: let people approve apps from verified publishers

This lets each person connect their own mailbox without an administrator, for apps from publishers Microsoft has verified, and only for the permissions you classify as low impact.

1. Sign in to the Microsoft Entra admin center at https://entra.microsoft.com as a Global Administrator.
2. Go to Identity > Applications > Enterprise apps > Consent and permissions > User consent settings.
3. Under User consent for applications, choose Allow user consent for apps from verified publishers, for selected permissions (Recommended), then select Save.

Microsoft says to classify the permissions people may approve, which is a separate step on its page. Microsoft: configure how users consent to applications

Microsoft announced in May 2026 that, from June 2026, users can no longer approve Contacts.ReadWrite, Contacts.Read.Shared, People.Read and several Tasks permissions unless the app is in the Mail client policy. It said existing approvals are not affected. Mail.Send is not on that list, but an app that asks for contacts or tasks at the same time needs an administrator. Microsoft message MC1304287

Way 2: let people ask an administrator

This lets a person request approval from the connect screen, and names the administrators who review the requests.

1. Sign in to the Microsoft Entra admin center as a Global Administrator.
2. Go to Entra ID > Enterprise apps > Consent and permissions > Admin consent settings.
3. Under Admin consent requests, set Users can request admin consent to apps they are unable to consent to to Yes.
4. Choose who can review the requests, and select Save. Microsoft says it can take up to an hour for the workflow to become enabled.

Reviewers see the requests in the Admin consent requests list. Microsoft says only Global Administrators can approve requests for apps asking for Microsoft Graph application permissions. Microsoft: configure the admin consent workflow

Way 3: an administrator approves it for the whole organisation

Use this when you already know you want the app.

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
2. Go to Entra ID > Enterprise apps > All applications, and select the app. Microsoft says an app is listed once it has been added to your tenant, for example when at least one person has approved it.
3. Under Security, select Permissions. Review what the app asks for, then select Grant admin consent.

Which role is enough depends on the permissions. Microsoft says a Privileged Role Administrator can grant consent for any permission, and that a Cloud Application Administrator, Application Administrator or AI Administrator can grant it for any permission except Microsoft Graph application permissions.

If the vendor gives you its application's client ID, you can also use Microsoft's tenant-wide consent address, https://login.microsoftonline.com/{organization}/adminconsent?client_id={client-id}, where {organization} is your tenant ID or a verified domain. Microsoft: grant tenant-wide admin consent to an application

By default this lets every user sign in to the app. Microsoft says you can restrict that by setting the app to require user assignment and assigning users or groups to it.

See what an app has been given, and take it away

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
2. Go to Entra ID > Enterprise apps > All applications, select the app, then select Permissions.
3. The Admin consent tab shows what applies to your whole organisation. The User consent tab shows what individual people approved.
4. To remove an organisation-wide permission, choose the permission, select the ... control beside it, then select Revoke permission.

Microsoft says you cannot revoke a permission in the User consent tab in the portal, and that revoking a permission does not stop people approving it again. To block that too, change the user consent setting in way 1. Microsoft: review permissions granted to enterprise applications

What Footer365 needs from this

Nothing. Footer365 is not involved in the approval, and it does not read or change the app's permissions. Once the app is connected and sends through the mailbox, Footer365 signs its mail like any other mail from that mailbox, provided the mailbox is covered by a signature rule. Choose how your CRM or app sends its mail