A work app asks for organization-wide Microsoft consent

A third-party app may show a Microsoft consent screen requesting mailbox, files or other organization data. Admin consent can grant the app access for more than one employee. Even a useful app deserves a deliberate review of publisher, permissions and the business need.

Before you start​

Ask the requester for the app's exact name, publisher, link, business owner and task. Use your organization's normal app review process; a sign-in prompt alone is not an approval ticket.

Do it step by step​

1. Open the request through the Microsoft Entra admin center or your documented workflow, not solely through an emailed consent link.
2. Confirm the application identity and publisher. Compare them with the vendor and integration described by the business owner; a verified publisher badge is a signal, not a guarantee.
3. Read every requested delegated and application permission. Determine whether the app needs the requested scope, especially broad access to mail, files or all users.
4. Check who will own the integration, what data it will retain and how access will be removed. Prefer a narrower approved option if the task does not require tenant-wide access.
5. Record the decision. Deny or defer unclear requests; approve only through the authorized admin role and recheck the resulting permissions and assigned users.

Check the result​

The app's granted permissions should match a documented use case and identifiable owner. Review access again when the vendor changes scope or the integration is retired.

If something goes wrong​

If the prompt appears during an urgent sign-in attempt, pause. A person blocked from using an app can submit the native approval request when that workflow is enabled; bypassing review is unnecessary.

Know the limit​

Admin consent can expose substantial organizational data; user consent is narrower and depends on policy. Neither means the app is safe merely because the Microsoft sign-in page is real. Microsoft's consent overview Microsoft's consent evaluation guidance