Skip to main content

SSO Login - Approval Required

Updated over 2 months ago

Users may encounter the following notifications when trying to authenticate with Microsoft. The guide below explains how administrators can approve user access.


Need Admin Approval

This message appears when your Microsoft 365 administrator has enabled advanced security settings within Microsoft Entra ID (Microsoft’s cloud-based identity and access management service) to restrict access to third-party applications like Ignite.

azure active directory - Microsoft Graph: "Need admin approval" for non  admin consent required scope "User.ReadBasic.All" during login - Stack  Overflow

How an Admin Can Grant Permissions

An administrator must create a new session and sign in to the application as an admin user to grant the necessary permissions.

To adjust the “Need Admin Approval” settings:

  1. Go to the Microsoft Entra admin center: entra.microsoft.com

  2. Navigate to Enterprise applications > User settings.

  3. There are two settings that control user authentication permissions:

    • Users can consent to apps accessing company data on their behalf

    • Users can consent to apps accessing company data for groups they own

Toggle both to Yes if you want users to authenticate and grant access themselves.
Toggle both to No to require administrator approval for all access requests.

Request Admin Consent

If users cannot grant consent themselves, an administrator can enable and manage consent requests.

  1. Sign in to the Microsoft Entra admin center as a Global Administrator.

  2. Navigate to Enterprise apps > User settings

    1. Alternatively use this link to go straight to the correct page.

  3. Enable “Users can request admin consent to apps they are unable to consent to.”

  4. Under Who can review admin consent requests, add one or more reviewers (trusted users with email inboxes) by clicking + Add users.

  5. Click Save.


Approval Required

Depending on the permissions configured by the Microsoft Entra admin, users may still see an approval notification.

When users reach the “Need admin approval” page:

  1. The user should click Request approval.

  2. Microsoft will send an approval email to the administrator.

  3. The admin can click Approve in the email to grant access.

  4. The user can then re-sign into Ignite using their Microsoft account — authentication will now succeed.


Additional Information

For more details, refer to Microsoft’s official documentation on Microsoft Entra ID admin consent:
👉 Learn about admin consent workflows in Microsoft Entra ID

If you continue to experience issues, contact your IT department or Microsoft support to verify that no additional security policies are preventing access.

Did this answer your question?