Why am I being asked to approve an app in Microsoft 365, and should I click Accept?

The short answer: an app or website wants to connect to your Microsoft 365 account, and Microsoft is asking whether you're happy to let it. Clicking Accept gives that app ongoing access to whatever it lists, which can include your email and files. If you weren't expecting it, or you're not sure what it is, don't accept. Ask your IT person first.

What this screen actually is

Lots of tools plug into Microsoft 365: scheduling apps, e-signature tools, CRM systems and so on. Instead of asking for your password, they ask Microsoft for permission to access your account. This is called app consent.

You'll usually see a screen titled Permissions requested. It shows:

• the name of the app;
• the publisher, sometimes with a verified badge, sometimes marked unverified;
• a list of what the app wants to do, such as "Read your mail", "Read and write your files" or "Maintain access to data you have given it access to";
• Accept and Cancel buttons.

Read that list. "Sign you in and read your profile" is fairly harmless. "Read and write your mail" or "Send mail as you" is a big deal.

Why accepting the wrong app is risky

This is the bit people don't expect. Criminals have learned that stealing passwords is getting harder, especially when you use multi-factor authentication (the code or app prompt on your phone). So instead, they build a fake app and trick you into approving it. This is called consent phishing.

It usually starts with an email that looks normal: a shared document, a voicemail, an invoice. You click the link, sign in with your real Microsoft account on the real Microsoft page, and get the Permissions requested screen. If you click Accept, the app can read your email in the background, and changing your password doesn't stop it, because the app was never using your password in the first place.

From there, criminals can watch your emails with customers and suppliers and send a convincing "our bank details have changed" message at just the right moment. If you're worried this may have already happened, read how do I know if my email has been hacked?

When it's fine to accept

It's normally fine when all of these are true:

• you started it yourself, for example you went to a tool's website and clicked "Sign in with Microsoft";
• you recognise the app and your business actually uses it (or your boss has asked you to set it up);
• the publisher looks right, ideally with a verified badge;
• the permissions make sense for what the app does. A calendar booking tool needing your calendar is fair. A PDF converter wanting all your email is not.

If any of those don't add up, click Cancel. Nothing breaks, and you can come back once someone has checked.

"Need admin approval" or "Approval required"

Sometimes you won't get the option to accept. Instead you'll see a message such as Need admin approval or Approval required. That means your business has (sensibly) stopped staff from approving apps on their own.

If your business has set up the approval process, you'll see a box to explain why you need the app and a Request approval button. Fill it in properly ("I need this to send quotes for signature" is much better than "need it") and send it. The request goes to the people your business has chosen to review apps, and you'll usually get an email when it's approved or turned down.

If there's no request button, contact your IT person directly and tell them the app name and what you need it for.

What admins can do

If you look after Microsoft 365 for your business, it's worth setting this up properly rather than leaving it to chance:

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com).
2. Go to Enterprise apps > Consent and permissions. Depending on your view, Enterprise apps may sit under Identity > Applications.
3. Under User consent settings, limit what staff can approve on their own. Many small businesses allow nothing, or only low-risk permissions from verified publishers.
4. Under Admin consent settings, turn on the option that lets users request admin consent, and pick who reviews the requests.

That way your people can still ask for the tools they need, and someone sensible checks each one first. It's also worth looking at Enterprise apps now and then to see which apps already have access. If you'd like a second pair of eyes on your setup, our free Microsoft 365 audit is a good place to start.

Common questions

I've already clicked Accept on something I'm not sure about. What now?

Tell your IT person straight away, and don't be embarrassed: these screens are designed to look routine. An admin can find the app in Enterprise apps, remove its access and check whether it has been reading or sending email.

Isn't it safe because it was a real Microsoft sign-in page?

Not necessarily. Consent phishing deliberately uses the genuine Microsoft page. The page being real tells you nothing about whether the app asking for access is trustworthy.

Why can my boss approve apps but I can't?

Admins can approve an app for the whole business, so that power is kept to a few people. It's not personal, it's about keeping control of which apps get in.