"Need admin approval" when connecting a scheduling tool to Microsoft 365

The screen you hit

You sign in to a scheduling tool with your work account, and Microsoft stops you:

Need admin approval. [App] needs permission to access resources in your organization that only an admin can grant.

Nothing is broken. That screen comes from Microsoft Entra ID, not from the app you are signing in to. Your tenant is configured so that users cannot consent to third-party apps on their own. The app asked for permission, Microsoft asked your organization, and you are waiting in the middle.

This page explains what the admin is being asked to approve, what to send them, and when the answer should be "no, use the built-in Microsoft feature instead".

What "permission" means here

Microsoft Graph splits permissions two ways.

Delegated permissions act on behalf of the signed-in user, and only on data that user can already see. If you cannot see a calendar in Outlook, an app using delegated permissions cannot see it either.

Application permissions act without a signed-in user and can be scoped to every mailbox in the tenant. These always need an admin.

Most scheduling tools use delegated permissions. Whether a delegated request still triggers the approval screen depends on your tenant's user consent policy. Many organizations turn user consent off entirely, which is why the same app connects fine at one company and is blocked at the next.

The second thing that matters is the scope: read versus write. Reading free/busy is a smaller ask than creating, editing, and deleting events. Microsoft's own guidance is to request the least privileged permission that does the job, and admins are right to ask why anything more is needed.

What OpenSlot asks for

OpenSlot reads Microsoft 365 free/busy through delegated Graph scopes, read-only. It uses only the free/busy part of Microsoft's answer and stores no calendar data; availability is computed live each time you generate a list. There is no write access, so it does not create, move, or delete anything on your calendar.

OpenSlot LLC is a Microsoft verified publisher, and the Outlook add-in is listed on Microsoft Marketplace.

If you are the person filling in the approval request box, that is the short version: read-only free/busy, delegated, no calendar data stored.

What to send your admin

Keep the request boring and specific. Admins reject vague ones.

1. What you are trying to do. "I email candidates and clients a list of times I am free. Today I copy them out of the Scheduling Assistant by hand."
2. What the app reads. Free/busy only, read-only, delegated, no calendar data stored.
3. Who published it. OpenSlot LLC, Kentucky, USA. Microsoft verified publisher. Listed on Microsoft Marketplace.
4. How to check it yourself. In the Microsoft Entra admin center, under Enterprise applications, an admin can see the exact permissions requested before granting anything, and can revoke consent later.
5. Scope of the rollout. If the admin would rather pilot it, they can approve it and then limit it to named people with user assignment.

If your tenant has admin consent requests turned on, your request lands in the admin's queue automatically. Approving it opens the app to everyone in your organization unless the admin also limits it to named people with user assignment. If it is turned off, you will need to email them. Our help pages are a reasonable thing to forward; so is support@useopenslot.com if they want to ask a direct question.

For the admin reading this

Three things are worth checking on any scheduling add-in, ours included:

• Read or write? A tool that only pastes times into an email body has no reason to hold write access to calendars. OpenSlot does not.
• What leaves the tenant? Ask whether calendar contents are copied to the vendor's systems. OpenSlot computes availability live from free/busy and keeps no calendar data.
• Publisher identity. Microsoft verified publisher status and a Marketplace listing are not a security audit, but they tell you who you are dealing with.

Consent is reversible. You can grant it for a pilot group, watch it, and revoke it in Enterprise applications if you change your mind.

When to say no

Sometimes the honest answer is that a third-party app is the wrong route.

If your organization's policy is that no multi-tenant third-party application gets consent, full stop, then no amount of justification changes it. Use what Microsoft already gives you: Scheduling Poll for group votes, or a personal booking page if your licensing includes it. Both live inside your tenant and need no outside consent.

If your problem is only internal meetings inside one tenant, the Scheduling Assistant plus a plain invite is faster than any add-in. Nobody needs to reply to an email if you can just book the slot.

The case for an add-in is narrower than most vendors admit: it is for the times you are emailing someone outside your tenant, whose calendar you cannot see, and you want readable times in the message instead of a link they have to click.

If you get unblocked

Once consent is granted, sign in again and the screen is gone. Settings roam across devices, so what you configure in the web app applies in the Outlook add-in on Windows, Mac, and Outlook on the web.

Every new account starts with a 14-day Pro trial, no card, which is usually enough for a pilot before anyone commits budget. The Free plan covers you plus one other person on a 7-day window. Pro is $7 per user per month or $72 a year. Team starts at $5 per user per month with a five-seat minimum.

Start at useopenslot.com if you want to test it before the approval conversation.