Microsoft 365: "Need admin approval"

Why Microsoft asks for an admin

• Since late 2025, Microsoft's default consent policy for work and school tenants stops employees from approving mail permissions such as Mail.Read and Mail.ReadWrite for an app. Microsoft shows Need admin approval instead of the usual consent screen.
• Your organization sets this, not your account and not MCPEmails. Being a verified publisher does not get an app past it, and some organizations have switched user consent off for every app.
• Personal Microsoft accounts (Outlook.com, Hotmail, Live) have no organization and no admin, so they never see this screen.
• Claude's own Microsoft 365 connector has the same requirement: Anthropic's help article says a Microsoft Entra Global Administrator must consent before anyone in the organization can use it. The steps below are for MCPEmails, which connects the mailbox to Claude, ChatGPT and other MCP clients.

If you are connecting your mailbox

1. In the MCPEmails dashboard, open Inboxes, then Connect inbox, choose Outlook and click Connect with Microsoft.
2. If Microsoft answers with Need admin approval, come back to the dashboard. It says your organization has to approve mailbox access and offers Get a link for your IT admin. The Outlook option in the connect window has the same link under Get the approval link for your admin.
3. Copy the link and send it to your IT admin by email or chat. It works for 7 days and can be opened more than once. Your admin does not need an MCPEmails account.
4. When your admin has approved, click Connect with Microsoft again. You sign in with your own account and the inbox connects.

If you are your own admin

• In the same dialog, click I'm the admin, approve now. It opens Microsoft's approval page in your tab, and after you approve you return to the dashboard to connect the mailbox.
• Sign in on that page with an account that holds one of the roles listed in the next section. A user account without a role cannot approve, even in a small tenant.

If you are the IT admin

• The link opens Microsoft's own admin consent page (login.microsoftonline.com/organizations/v2.0/adminconsent) for MCPEmails. You sign in with your Microsoft work account on Microsoft's page. MCPEmails never sees your password.
• Approving needs a role that can grant tenant-wide consent for delegated permissions. Microsoft lists Privileged Role Administrator, Cloud Application Administrator, Application Administrator and AI Administrator, and a Global Administrator can do it too.
• Review the permissions and accept. The approval covers the whole organization once. Each person still signs in with their own account when they connect, and gets access only to their own mailbox.
• You then land on an MCPEmails page that says whether Microsoft confirmed the approval. Nothing else is needed from you.
• The link grants nothing by itself. It only starts Microsoft's flow, and nothing changes in your tenant until you accept there.
• Prefer the admin center? If MCPEmails already appears under Entra ID, Enterprise apps, All applications, open it, choose Permissions and click Grant admin consent. Microsoft's guide describes that route.

What the admin approves

• Mail.ReadWrite (delegated): read and change mail in the signed-in person's mailbox, so the AI can search, read, write drafts, move, flag, manage folders and delete.
• Mail.Send (delegated): send mail as the signed-in person. Mail.ReadWrite does not cover sending, so it is a separate permission.
• offline_access: keep the connection working without signing in again, until the person disconnects or access is removed.
• When each person signs in, MCPEmails also asks for openid, profile and email to read their name and address. Consent policies do not restrict these sign-in basics, so the admin approval leaves them out.
• Every permission is delegated. MCPEmails asks for no application permissions, so it acts only for the person who signed in and cannot open other mailboxes in your tenant.
• Messages are fetched live from Microsoft for each request and are not stored. The token from each sign-in is encrypted at rest, and data is stored in Stockholm. See security.

Limit or remove access later

• To let only some people connect, turn on Assignment required for MCPEmails under Enterprise apps and assign the users or groups who may sign in. Microsoft's guide has the steps.
• To remove it for the whole organization, delete or disable MCPEmails under Enterprise apps.
• Each person can disconnect their own mailbox at any time by deleting the inbox in the MCPEmails dashboard.

If it still does not work

• "The approval did not go through". Microsoft did not confirm the approval, so Outlook stays blocked. The admin opens the link again, signed in with an account that holds one of the roles above.
• "Not approved". The approval was cancelled on Microsoft's screen and nothing changed. Open the link again when ready.
• "This link has expired" or "This link is not valid". Links last 7 days and must be copied whole. Get a fresh one from the dashboard.
• "Please start again". The approval took more than 10 minutes or finished in a different browser. Open the link again and finish in that browser.
• No Outlook mailbox. An account without an Exchange Online mailbox, such as an admin account without an Exchange licence, has nothing to connect, so MCPEmails refuses it. If your mail is hosted elsewhere, connect it with IMAP instead.
• A request form instead of the approval page. If your organization has turned on Microsoft's admin consent workflow, a user who tries to connect may see a form to request approval. The admin can approve that request, or simply open the MCPEmails link.

Check it yourself

MCPEmails is open source. These files build the link, start the approval and list the permissions this page describes:

• outlook-admin-link.ts The signed, seven-day approval link and the result statuses
• admin-consent/route.ts The public route the link opens, and the permissions it asks the admin for
• outlook-oauth.ts The permissions each person grants at sign-in, and how a "Need admin approval" answer is recognised