Need admin approval: why Instantly, Smartlead and PlusVibe cannot connect your Microsoft 365 inboxes

You connect a Microsoft 365 inbox to your sequencer with the Microsoft sign-in button. The password is accepted, and then, instead of returning you to the sequencer, Microsoft shows this:

Need admin approval
<Sequencer> needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.

Nothing is wrong with the mailbox, the password or the sequencer. The tenant is asking for a one-time decision that only an administrator can make, and once it is made, every mailbox in the tenant connects normally.

What does Need admin approval mean?

It means the sequencer asked for permissions that an ordinary user is not allowed to grant. Reading and sending a mailbox’s mail is classed as high impact, and by default Microsoft 365 only lets users consent to low-impact apps. An administrator has to approve the app once, on behalf of the whole organization.

The setting behind it is the tenant’s user consent policy. On the tenants we checked it was Microsoft’s recommended default, which lets users consent only to low-impact permissions from verified publishers. Mailbox read and send are not on that list, so the sign-in stops at approval.

Which sequencers does it affect?

All of the ones we have connected. We saw the same prompt from PlusVibe and Instantly on the same tenant on 31 August 2026, which rules out anything specific to one vendor, and from Smartlead on 14 September 2026. Any sequencer that connects Microsoft 365 over OAuth asks for mailbox access, so expect it from any of them.

How to fix it, once for the whole tenant

1. In the sequencer, start connecting a Microsoft account as you would for a mailbox.
2. Sign in as the tenant’s Global Admin, usually admin@yourtenant.onmicrosoft.com, not as a mailbox.
3. On the permissions screen, tick Consent on behalf of your organization.
4. Click Accept.
5. Connect the mailboxes as normal. They no longer stop at approval.

The tick box is the part that matters. Without it, the admin consents only for their own account and every mailbox still stops at approval. With it, the grant covers every user in the tenant, current and future.

You can remove the admin account from the sequencer afterwards. The approval is stored in the tenant, in Entra, not in the sequencer’s connection, so deleting the connection does not undo it.

Why you cannot approve it from Entra in advance

The obvious idea is to find the sequencer under Enterprise applications in Entra and grant consent there before anyone signs in. On our tenants that did not work, because the app was not there. A sign-in that stops at Need admin approval registers nothing in the tenant, so there is nothing to approve until an admin completes a sign-in. The sign-in as the Global Admin is what creates the app and the grant together.

Do not loosen user consent to get around it

Entra will let you change the user consent setting so any user can approve any app. That also clears the prompt, and it is the wrong fix. It lets every account in the tenant hand mailbox access to any app that asks, which is exactly what the default is there to stop. One admin consent per sequencer does the same job and keeps the setting as it was.

If the sign-in fails before the approval screen

Need admin approval appears after a successful password check. If the sign-in fails earlier, it is a different problem. A tenant with Security Defaults on can refuse the sign-in itself with AADSTS530035, and the same setting blocks SMTP sign-in with a 535 error. Turn Security Defaults off first, then come back to the approval.

For our own tenants, admin consent sits on the onboarding checklist next to Security Defaults, because neither can be done from inside the sequencer. If you buy Microsoft 365 inboxes from anyone, ask who holds the Global Admin, since that is the account that has to do this.