how to add "Mail.ReadWrite" permission in user consent for this app "Make"?

Question

Capture1111.JPG

how to add "Mail.ReadWrite" permission in user consent for this app "Make"?

Answer 1

You can add consent on behalf of specific user(s) via Graph API/PowerShell, check this article for detailed instructions: https://michev.info/blog/post/6080/how-to-manage-entra-id-delegate-permissions-for-specific-users

If you want to add tenant-wide consent instead, use the AllPrincipals value.

Answer 2

Mail.ReadWrite is considered a high-impact permission and is blocked from end-user consent in the Microsoft-recommended user consent policy.

To allow the Make app to use Mail.ReadWrite, an administrator must grant admin consent for that permission to the app’s enterprise application:

1. Sign in to the Microsoft Entra admin center with at least Privileged Role Administrator (or Global Administrator).
2. Go to Identity → Applications → Enterprise applications and select the Make app.
3. Open Permissions and ensure Mail.ReadWrite (Microsoft Graph delegated permission) is added to the app registration (if not, it must be added in the app registration’s API permissions/Manifest as described in the “Add permissions to an application” section).
4. In the enterprise application’s Permissions pane, select Grant admin consent for <Organization> to approve Mail.ReadWrite on behalf of all users.

Because Mail.ReadWrite requires admin consent, users cannot add it via user consent alone. If the app no longer needs such broad access, remove Mail.ReadWrite from the app registration to reduce risk.

---

References:

• Manage app consent policies (ms-graph)
• Microsoft Graph permissions reference
• Update an app's requested permissions in Microsoft Entra ID (portal)
• Update an app's requested permissions in Microsoft Entra ID (ms-graph)
• App consent grant investigation
• Developer’s guide to requesting permissions and consent in Microsoft Identity Platform
• Corporate account apps registration error: AADSTS90094 - Microsoft Q&A