> ## Documentation Index > Fetch the complete documentation index at: https://docs.coalesc.ai/llms.txt > Use this file to discover all available pages before exploring further. # Resolve Microsoft 365 permission issues > Check Microsoft roles, have IT approve Coalesc and reconnect using the intended work mailbox. [Lire en français](https://docs.coalesc.ai/guide/permissions-microsoft.md) ## Microsoft says administrator approval is required This message appears at Microsoft during Outlook connection. Being a firm owner or administrator in Coalesc does not give you Microsoft 365 administrator privileges. Permission to use an application, access a mailbox and approve the application are separate. First check that you selected the correct work account and organization. A personal Microsoft account or an administrator account from another organization does not resolve your firm's approval requirement. ## 1. Check the connecting account's roles Ask your Microsoft 365 administrator or IT provider to follow this path: 1. Open the [Microsoft 365 admin center](https://admin.microsoft.com). 2. Go to **Users › Active users**. 3. Select the account attempting to connect Outlook to Coalesc. 4. Open **Account › Roles** and inspect the assigned roles. **Manage roles** is for someone authorized to change them. Check this even when the person believes they are already an administrator: **Billing Administrator** and **Global Reader** do not, by themselves, allow application admin consent. A disabled control or inability to save is not solved by selecting more roles; involve an authorized administrator. Microsoft documents [how to inspect and manage roles](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/assign-admin-roles?view=o365-worldwide). Menu labels can vary with language and interface version. ## 2. Have an authorized administrator approve Coalesc **The recommended route is administrator approval of the application, followed by connection of the normal work mailbox.** Every Coalesc user does not need permanent administrator privileges. For this connector's delegated permissions, Microsoft allows roles including **Cloud Application Administrator** and **Application Administrator** to grant consent. IT must check the active role, actual requested permissions and firm policies before approving. When the application already exists in the firm's tenant, the administrator can: 1. Open the [Microsoft Entra admin center](https://entra.microsoft.com). 2. Go to **Entra ID › Enterprise apps › All applications**. 3. Find the Coalesc application and verify its **application ID** and publisher with Coalesc rather than relying on its name alone. 4. Open **Security › Permissions**, review the requested access and, when permitted by firm policy, select **Grant admin consent**. Adding an account under **Users and groups** may be necessary when assignment is required, but **does not replace permission consent**. Tenant-wide consent is an IT decision whose scope must be reviewed. See [Microsoft's consent procedure](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent). If the application is missing, do not register a replacement application. Use **Request approval** when Microsoft offers it, or ask Coalesc for the approval path for the current application. A blocked page is not evidence that a request reached your administrator. > [!WARNING] > > Granting Global Administrator can unblock consent, but gives much broader privileges than needed. It is not the standard setup for every user. If IT granted an elevated role while troubleshooting, they should review that assignment after approval. Do not disable multifactor authentication or the firm's security policies. ## 3. Retry with the intended mailbox and verify the result After approval or an authorized role change, refresh your Microsoft session and restart the connection from **Settings › Connections** in Coalesc. Use **Connect**, or **Reconnect** when offered, with the account whose mailbox should be read. Do not automatically use the administrator account that approved the application. Check the displayed connection address and selected folder. Using an agreed test recipient, verify an incoming message with a non-sensitive attachment, then sending and actual receipt from the intended address. A connected status alone does not prove reading and sending work. Do not repeatedly **Disconnect / Connect** to refresh a folder or troubleshoot every error. For a synchronization problem, start with **Sync now** or **Retry**, and escalate a persistent error. ## Separate case: shared mailboxes An Exchange shared mailbox such as `info@yourfirm.ca` is not an ordinary user account. Microsoft says to [keep direct sign-in blocked](https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes?view=o365-worldwide). **Do not create shared credentials or enable direct sign-in as a workaround.** Seeing the shared mailbox in Outlook does not mean Coalesc is connected to it: the documented connection reads the signed-in account's mailbox. Ask Coalesc and IT to verify the shared-mailbox flow actually supported, delegated access and sending identity. Application consent alone does not prove that workflow works. ## Message to send your IT team Copy this message and complete the details: > Hello, I am connecting our Microsoft 365 mailbox to Coalesc, but Microsoft requires administrator approval. Please check the connecting account's roles, the correct Microsoft tenant and consent for the Coalesc application. We then need to resume using the intended work mailbox without unnecessarily giving it permanent administrator privileges. > > Account used: … > > Intended mailbox and type (user or shared): … > > Error message/code and test time: … If needed, include a screenshot with client data redacted and the correlation ID Microsoft displays. Never send a password, multifactor code, access token or callback URL containing an authorization code. For IT: the connector currently requests delegated `offline_access`, `User.Read`, `Mail.Read`, `Mail.ReadWrite` and `Mail.Send`. `Mail.ReadWrite` is used to create a draft before sending so replies remain linked to their request. Always inspect the actual consent prompt; this list does not authorize adding broader application permissions. A sending failure after consent needs separate diagnosis, not another Global Administrator assignment. ## Contact Microsoft support If approval remains blocked, ask your administrator or IT provider to follow [Microsoft's business support procedure](https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support?view=o365-worldwide). In the [Microsoft 365 admin center](https://admin.cloud.microsoft), open **Help & support**, describe the consent error and select **Contact Support** if the suggested help does not resolve it. Choose phone or email when offered. Include the error code, test time and correlation ID described above, without credentials or client documents. > [!NOTE] > > These business support options require an administrator. If all subscriptions were purchased through a partner, Microsoft directs you to that partner for support. If your administrator cannot access the center, the [same support page](https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support?view=o365-worldwide) links to current phone contact options by country or region. ## Official Microsoft documentation * [Assign and manage administrator roles](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/assign-admin-roles?view=o365-worldwide): inspect role assignments and use the permissions appropriate to the task. * [Grant tenant-wide admin consent](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent): authorized roles, permission review and the Enterprise apps procedure. * [Troubleshoot application consent errors](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-sign-in-unexpected-user-consent-error): explanations for errors including `AADSTS90093` and `AADSTS90094`. * [Understand shared mailboxes](https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes?view=o365-worldwide): delegated access, sending permissions and the direct-sign-in restriction. Microsoft references checked on October 20, 2026. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.