Microsoft Entra permission issues

Question

Good Morning,I'm having trouble with some permission settings. I have a couple of users that use the Workable application but aren't able to integrate their emails to the site. These users are able to sign into the application and use it just fine, it's just whenever they try to integrate their email it says they need admin approval of some kind. I've reached out to Workable support for any tips since they are the ones that set this up for us in the first place, and they just referred me to the basic permission guides that Microsoft has. I tried them all and it still doesn't work. Either way, we have other users besides those two that are able to integrate their email and use the site just fine, it's just these two users that can't for some reason. Even though it seems like everyone has the same permission settings, I don't understand why it doesn't work for these two users. Please help.

Answer 1

Hello NetTech Admin,

Welcome to Microsoft Q&A

This "Need admin approval" screen is the OAuth 2.0 Consent Prompt. It is appearing because the application (Workable) is requesting a permission scope (likely Mail.Read, Calendars.Read, or Contacts.Read) that your tenant's User Consent Policy does not allow standard users to authorize themselves.

Since Workable is a trusted business application for your org, the standard fix is to perform a Tenant-Wide Admin Consent. This explicitly tells Entra ID: "I, the Admin, trust this app. Don't ask my users for permission anymore."

1. Log in to the Microsoft Entra Admin Center.

Navigate to Applications > Enterprise applications.

Search for and select "Workable - Production" (matches your screenshot).

In the left menu, click Permissions.

Click the blue button: "Grant admin consent for [Your Organization Name]".

Note: You will be prompted to sign in and accept.

1. Once done, the "Need admin approval" screen will disappear for all users immediately.

Alternative (If you want to allow users to do it themselves): If you prefer not to grant blanket consent, you must adjust the policy:

• Go to Enterprise applications > Consent and permissions > User consent settings.
• Select "Allow user consent for apps from verified publishers...". (Since Workable has a blue checkmark in your screenshot, this setting would unblock them).

More information:

• Grant tenant-wide admin consent to an application
• Configure how users consent to applications

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!