Documentation Navigation

Admin consent guide

Last updated: October 26, 2026

A work Microsoft 365 mailbox often will not connect until an administrator approves InflowMail once for the company. If you are not that admin, you cannot click through it yourself. Send this page to the person who manages Microsoft 365. Personal accounts (@outlook.com, @hotmail.com, @gmail.com) do not need this.

Why this happens

Microsoft 365 and Google Workspace let administrators control which third-party apps can access company email. This is a sensible security default - it stops random apps from siphoning company data without oversight. The flip side is that legitimate apps like InflowMail need explicit approval before users can connect.

You'll only see this if your account is on a managed business tenant. Personal accounts (@outlook.com, @hotmail.com, @gmail.com) don't have this restriction and connect freely.

Microsoft 365

If you are not a Microsoft 365 admin

Connecting a company mailbox shows "Need admin approval" or "This app is blocked." That is your company's Microsoft setting, and only an administrator can clear it. Find the person who set up company email (in a small business, usually the owner) and send them the link below. They sign in with their admin account and click Accept.

Link for your admin:

https://login.microsoftonline.com/organizations/adminconsent?client_id=0e39696b-3cd9-46eb-b4e2-a7ddac0e59dd&redirect_uri=https%3A%2F%2Fwww.inflowmail.ai%2Fapi%2Faccounts%2Foauth%2Fmicrosoft%2Fcallback&state=adminconsent

They must be signed in as a Microsoft 365 admin for your company, not as you. Microsoft then asks them to approve InflowMail for the organization.

  1. Send your admin the link. One approval covers the whole company.
  2. After they accept, the approval does not connect your mailbox by itself. In InflowMail, add Microsoft and sign in as yourself.
  3. Until they approve, read and send that mail in Outlook on the web. An app password will not work for Microsoft 365.

Message you can forward:

If you're a Microsoft 365 tenant admin

Sign in with your admin account and approve InflowMail once. After that, people in your company can connect their own mailbox.

What InflowMail requests (delegated permissions)

  • openid - sign the user in
  • profile - show the user's name
  • offline_access - stay connected without asking the user to sign in every hour
  • User.Read - read the signed-in user's basic profile (name and email)
  • Mail.Read - read messages in the signed-in user's mailbox
  • Mail.ReadWrite - move, flag, archive and delete messages when the user asks
  • Mail.Send - send mail the user writes in InflowMail
  • Calendars.Read - read the user's calendar for meeting context
  • Contacts.Read - read the user's contacts to recognise known senders
  • Tasks.ReadWrite - create Microsoft To Do tasks from email when the user asks
  • email - read the user's email address to match their InflowMail account

"Sign in with Microsoft" asks only for openid profile email User.Read. The mail, calendar, contacts and tasks permissions are requested only when a user connects a mailbox.

These are delegated permissions - InflowMail can only act as the user who signed in, scoped to that user's mailbox. We don't request Mail.Read.All or any other tenant-wide application permissions.

Access levels: you can approve less

The list above is the most InflowMail asks for. Each user picks a level when they connect a mailbox, and you can approve only the level you are comfortable with. InflowMail works out what it may do from the permissions Microsoft actually grants, so if you approve read only, it reads and never tries to change or send.

Level Permissions What works
Read only openid profile offline_access User.Read Mail.Read Inbox, AI sorting, daily briefings, search and reading. Nothing in the mailbox changes and nothing is sent.Approve this level for your organization
Read + organise openid profile offline_access User.Read Mail.Read Mail.ReadWrite Adds archive, delete, flag, mark read, move, folders and drafts. No sending.Approve this level for your organization
Full openid profile offline_access User.Read Mail.Read Mail.ReadWrite Mail.Send Adds sending and replying from InflowMail.Approve this level for your organization

Optional add-ons each user can tick: Calendars.Read (meeting context), Tasks.ReadWrite (Microsoft To Do tasks from email), Contacts.Read (recognise known senders). Leave them out of your approval and InflowMail simply skips them.

The per-level links use Microsoft's v2 admin consent endpoint (/organizations/v2.0/adminconsent with a scope list), which approves only the listed permissions. The main link above uses the classic endpoint, which approves every permission on the app registration. A user who later picks a higher level than you approved sees "Need admin approval" for the extra permissions, and can connect at the approved level instead.

Publisher verification

InflowMail has not completed Microsoft publisher verification yet, so Microsoft's consent screen shows the app without the blue verified badge. Many organisations only let users approve apps from verified publishers, which is a common reason users see "Need admin approval". An administrator can still review the permissions above and approve the app for the organisation.

Common error codes

Code Meaning
AADSTS65001 User or admin has not consented to this app. Tenant admin needs to approve.
AADSTS50105 User is not assigned to the application. Admin needs to assign the user (or set the app to "users can self-assign").
AADSTS90094 Admin approval required for one or more permissions.
AADSTS90095 The user sent an approval request through your admin consent workflow. Approve it under Enterprise applications → Admin consent requests; Microsoft emails the user when you do.
consent_required Generic OIDC code for "user or admin must consent before continuing."

Google Workspace

If you're a regular user

If your Workspace blocks third-party apps, you'll see "This app is blocked" or a similar message instead of the consent screen. Same drill: ask your Workspace admin to add InflowMail as a Trusted app.

If you're a Google Workspace admin

  1. Open the Google Admin console.
  2. Go to Security → Access and data control → API controls → Manage Third-Party App Access.
  3. Click "Add app" → "OAuth App Name Or Client ID."
  4. Search for "InflowMail" or paste the OAuth client ID below.
  5. Choose "Trusted: Can access all Google services" (recommended) or "Limited" if you want to restrict to specific scopes.

What InflowMail requests

  • gmail.modify - read mail and labels, change labels, move/archive and send (does not include permanent delete)
  • tasks.readonly - read the user's Google Tasks
  • calendar.readonly - read the user's calendar
  • contacts.readonly - read contact names and email addresses
  • openid profile email - basic identity

That is the Full level. A user who picks Read only is asked for gmail.readonly instead of gmail.modify, and can untick tasks, calendar and contacts. Google has no permission for "organise but not send": gmail.modify covers both, so Read + organise asks for gmail.modify and InflowMail itself refuses to send from that mailbox. In the Admin console, "Limited" access to gmail.readonly lets your users connect at Read only.

IMAP fallback

If Google sign-in is blocked, Gmail still accepts IMAP with an app password when 2-Step Verification is on. Microsoft retired IMAP/SMTP passwords for Outlook.com and Microsoft 365 - those mailboxes have to use Microsoft sign-in.

For IT: security posture

  • Delegated permissions only. InflowMail never holds tenant-wide application permissions. Each user authenticates individually and grants access to their own mailbox.
  • OAuth tokens stored encrypted at rest. AES-256, with a key unique to each user account. Tokens are refreshed regularly via standard OAuth refresh flows.
  • No password storage. InflowMail never sees or stores user passwords. Even for IMAP fallback, app passwords are stored encrypted and can be rotated by the user at any time.
  • Access log. Each time message content is opened in the app, it is logged with who opened it (the user or a helper they added) and shown to the user in their Data Access Log.
  • Revocable. Users (and admins) can revoke InflowMail's access at any time from the Microsoft 365 / Workspace admin consoles. Tokens are invalidated immediately on revoke.
  • More: full security documentation.

Still stuck?

If you've followed the steps above and your admin has approved InflowMail but you still can't connect, please open a support ticket and include the error code from the connection blocked page.