Resolve Microsoft 365 permission issues

Lire en français

​

Microsoft says administrator approval is required

This message appears at Microsoft during Outlook connection. Being a firm owner or administrator in Coalesc does not give you Microsoft 365 administrator privileges. Permission to use an application, access a mailbox and approve the application are separate. First check that you selected the correct work account and organization. A personal Microsoft account or an administrator account from another organization does not resolve your firm’s approval requirement.

​

1. Check the connecting account’s roles

Ask your Microsoft 365 administrator or IT provider to follow this path:

1. Open the Microsoft 365 admin center.
2. Go to Users › Active users.
3. Select the account attempting to connect Outlook to Coalesc.
4. Open Account › Roles and inspect the assigned roles. Manage roles is for someone authorized to change them.

Check this even when the person believes they are already an administrator: Billing Administrator and Global Reader do not, by themselves, allow application admin consent. A disabled control or inability to save is not solved by selecting more roles; involve an authorized administrator. Microsoft documents how to inspect and manage roles. Menu labels can vary with language and interface version.

​

2. Have an authorized administrator approve Coalesc

The recommended route is administrator approval of the application, followed by connection of the normal work mailbox. Every Coalesc user does not need permanent administrator privileges. For this connector’s delegated permissions, Microsoft allows roles including Cloud Application Administrator and Application Administrator to grant consent. IT must check the active role, actual requested permissions and firm policies before approving. When the application already exists in the firm’s tenant, the administrator can:

1. Open the Microsoft Entra admin center.
2. Go to Entra ID › Enterprise apps › All applications.
3. Find the Coalesc application and verify its application ID and publisher with Coalesc rather than relying on its name alone.
4. Open Security › Permissions, review the requested access and, when permitted by firm policy, select Grant admin consent.

Adding an account under Users and groups may be necessary when assignment is required, but does not replace permission consent. Tenant-wide consent is an IT decision whose scope must be reviewed. See Microsoft’s consent procedure. If the application is missing, do not register a replacement application. Use Request approval when Microsoft offers it, or ask Coalesc for the approval path for the current application. A blocked page is not evidence that a request reached your administrator.

​

3. Retry with the intended mailbox and verify the result

After approval or an authorized role change, refresh your Microsoft session and restart the connection from Settings › Connections in Coalesc. Use Connect, or Reconnect when offered, with the account whose mailbox should be read. Do not automatically use the administrator account that approved the application. Check the displayed connection address and selected folder. Using an agreed test recipient, verify an incoming message with a non-sensitive attachment, then sending and actual receipt from the intended address. A connected status alone does not prove reading and sending work. Do not repeatedly Disconnect / Connect to refresh a folder or troubleshoot every error. For a synchronization problem, start with Sync now or Retry, and escalate a persistent error.

​

Separate case: shared mailboxes

An Exchange shared mailbox such as info@yourfirm.ca is not an ordinary user account. Microsoft says to keep direct sign-in blocked. Do not create shared credentials or enable direct sign-in as a workaround. Seeing the shared mailbox in Outlook does not mean Coalesc is connected to it: the documented connection reads the signed-in account’s mailbox. Ask Coalesc and IT to verify the shared-mailbox flow actually supported, delegated access and sending identity. Application consent alone does not prove that workflow works.

​

Message to send your IT team

Copy this message and complete the details:

Hello, I am connecting our Microsoft 365 mailbox to Coalesc, but Microsoft requires administrator approval. Please check the connecting account’s roles, the correct Microsoft tenant and consent for the Coalesc application. We then need to resume using the intended work mailbox without unnecessarily giving it permanent administrator privileges. Account used: … Intended mailbox and type (user or shared): … Error message/code and test time: …

If needed, include a screenshot with client data redacted and the correlation ID Microsoft displays. Never send a password, multifactor code, access token or callback URL containing an authorization code. For IT: the connector currently requests delegated offline_access, User.Read, Mail.Read, Mail.ReadWrite and Mail.Send. Mail.ReadWrite is used to create a draft before sending so replies remain linked to their request. Always inspect the actual consent prompt; this list does not authorize adding broader application permissions. A sending failure after consent needs separate diagnosis, not another Global Administrator assignment.

​

Contact Microsoft support

If approval remains blocked, ask your administrator or IT provider to follow Microsoft’s business support procedure. In the Microsoft 365 admin center, open Help & support, describe the consent error and select Contact Support if the suggested help does not resolve it. Choose phone or email when offered. Include the error code, test time and correlation ID described above, without credentials or client documents. If your administrator cannot access the center, the same support page links to current phone contact options by country or region.

​

Official Microsoft documentation

• Assign and manage administrator roles: inspect role assignments and use the permissions appropriate to the task.
• Grant tenant-wide admin consent: authorized roles, permission review and the Enterprise apps procedure.
• Troubleshoot application consent errors: explanations for errors including AADSTS90093 and AADSTS90094.
• Understand shared mailboxes: delegated access, sending permissions and the direct-sign-in restriction.

Microsoft references checked on October 20, 2026.