When a user sees "Need admin approval" while connecting Microsoft 365 in Clarify, it means your Microsoft tenant hasn't yet granted Clarify permission to access the required Graph API scopes. A Global Administrator needs to grant this consent once — after that, all users in the tenant can connect.
ℹ️ If admin consent was previously granted and users are still blocked, re-grant it using any path below. Clarify recently updated its Microsoft app permissions — existing consent grants may reference outdated scopes.
The fastest fix
Have a Global Administrator in your organization follow these steps:
Go to Settings → Account → Connected accounts in Clarify
Click Connect next to Microsoft
Sign in with the Global Admin's Microsoft account
On the Microsoft permissions screen, check "Consent on behalf of your organization" before clicking Accept
This grants org-wide consent in a single step and immediately unblocks all affected users. The admin does not need to remain a Clarify user — they can disconnect their account once consent is recorded.
ℹ️ Don't use admin.microsoft.com to find the Clarify app. Some tenants (particularly those managed via GoDaddy or third-party M365 resellers) redirect admin.microsoft.com to the reseller portal. Use entra.microsoft.com directly.
Why this happens
Clarify requests Microsoft Graph API permissions to read your email and calendar. Microsoft requires an organization-level admin to approve these permissions before any user in the tenant can connect — even if that user is an admin themselves. This is a standard Microsoft tenant security control.
If admin consent was never recorded, every user in the tenant hits the "Need admin approval" screen regardless of their own permissions.
Alternative paths
If the fastest fix isn't an option, two alternatives exist:
Path 1 — Entra admin consent button
Go to entra.microsoft.com → Enterprise applications
Search for and open the Clarify app
Go to Security → Permissions
Click Grant admin consent for [your organization]
Path 2 — Direct admin consent URL
Your Clarify support contact can generate a direct admin consent URL for your tenant. Navigate to it while signed in as a Global Admin and click Accept.
Verify consent was recorded
After any consent attempt, confirm it worked before asking the user to try again:
Go to entra.microsoft.com → Enterprise applications → Clarify
Open Security → Permissions
Check the Permissions granted table — Clarify's Graph scopes should appear with status Granted for [your org]
If the table is empty or unchanged, consent wasn't recorded. Try the fastest fix.
Diagnosing what went wrong (Entra sign-in logs)
If a user is still blocked after consent appears granted, pull the sign-in logs to see the exact Microsoft error:
Go to entra.microsoft.com → Monitoring & Health → Sign-in logs
Filter by the affected user's email and the relevant time window
Find entries where the application is Clarify and status is Failure
Open the entry and note the Sign-in error code and Failure reason
Error code reference
AADSTS 90094 — Admin consent is required for the permissions requested. Grant admin consent using any path above.
Still blocked?
If consent is confirmed granted and users are still blocked, contact Clarify support with the affected user's email and workspace slug. A screenshot of the Entra sign-in log entry (including the Sign-in error code) helps us diagnose faster.