'Admin approval required' message when connecting Microsoft 365

When you connect your Microsoft 365 (Office 365) account to SpinOffice, do you get the message "Need admin approval" for the app MulberryGarden SpinOffice? Then your organization has set things up so that only an IT administrator may give external apps access. This is a common security setting in Microsoft 365, not a fault in SpinOffice.

An administrator only has to do this once for the whole organization. After that, all colleagues can connect their own accounts.

What should I do as a user?

Forward this article to your IT administrator or IT provider. You can't resolve the message yourself.

What should the IT administrator do?

This requires an account with the Global Administrator, Privileged Role Administrator or Cloud Application Administrator role. Choose one of the three methods below.

Method 1: via the direct link (fastest)

1. Open this link and sign in with the administrator account:
   https://login.microsoftonline.com/organizations/adminconsent?client_id=[CLIENT-ID]
2. Check the requested permissions and click Accept.

Method 2: via the Microsoft Entra admin center

1. Go to entra.microsoft.com.
2. Choose Identity › Applications › Enterprise applications.
3. Search for MulberryGarden SpinOffice.
   App not in the list? Then first have a user try to connect their account in SpinOffice. The app then appears in the list.
4. Open Permissions and click Grant admin consent for [your organization].

Method 3: from the message itself

1. In the message, click "Have an admin account? Sign in with that account".
2. Sign in with the administrator account.
3. Tick "Consent on behalf of your organization" and click Accept.

Which permissions does SpinOffice request?

SpinOffice connects to your mailbox via Microsoft Graph and OAuth 2.0. Your password is not stored in SpinOffice. The app requests access to:

• Mail.ReadWrite
• Mail.Send
• Mail.ReadWrite.Shared
• Mail.Send.Shared

SpinOffice only has access to the mailbox of the user who makes the connection.

I still get the message

• Consent given only for the administrator. Use method 1 or 2. These always apply to the whole organization.
• The browser remembers the old session. Sign out of Microsoft in your browser, or try in a private window.
• "Assignment required" is turned on. The user then sees a different error message (AADSTS50105). The administrator then has to add the user under Enterprise applications › MulberryGarden SpinOffice › Users and groups.