Issue
When signing into CloudExtend (Outlook, Excel, or Analytics), you may see a Microsoft prompt that says:
“Need admin approval”
CloudExtend requires permissions that your admin has disabled.
This occurs when a Microsoft Global Admin has not yet granted consent for CloudExtend to access the data and APIs required for the application to function.
CloudExtend applications rely on Microsoft Graph permissions, and Microsoft requires admins to explicitly approve these permissions before users can use the app.
This prompt most commonly appears:
When a user logs into a CloudExtend app for the first time
When scheduling the first saved search in CloudExtend Analytics
When users in restricted organizations attempt to sign in and admin consent policies are enforced
Why This Happens
Microsoft allows IT administrators to finely control:
Which apps users can log into
Whether users may grant consent to apps
Which permissions enterprise applications may request
If Microsoft admin consent has not been granted for CloudExtend, users will be blocked until a Global Admin approves the application.
How to Grant Consent (Outlook & Excel Apps)
Open the link and log in using a Microsoft Global Admin account.
To Enable Consent on behalf of your Organization
To Enable Consent on behalf of your Organization
Step 1: Click the Maintain access to data and enable the Consent on behalf of your organization.
Step 2: Click Accept.
Step 3: No further steps are needed as permissions have been granted to all users.
To Enable Consent for a Specific Set of Users
To Enable Consent for a Specific Set of Users
Step 1: Validate that you did not check "Consent on behalf of your organization" on the previous pop up if it was shown and click Accept.
Step 2. Go to Microsoft Entra Admin Center (https://entra.microsoft.com).
and search for Enterprise Applications. Microsoft Entra provides the best experience from Microsoft, however, you can also do the same at https://portal.azure.com.
Step 3: Next, search the Enterprise Applications for CloudExtend Identity.
There should be at least one user who has accepted the consent application for it to show in the portal. That's why, we need the admin to consent and log in first.
Step 4: Go to Assign users and groups
Step 5: Assign the desired users or groups. By addings groups you can make this process dynamic, ie anytime a user is added to a group they will automatically have access.
Additional Steps for ExtendInsights Analytics
CloudExtend Analytics requires additional Graph permissions because it must read and write Microsoft 365 data when running scheduled or automated refreshes.
A Microsoft Global Admin must:
Open the CloudExtend Analytics consent link.
Log in as a Global Admin.
Approve the elevated Graph permissions.
Once approved, end users can schedule searches and refresh data normally
Still Seeing “Need Admin Approval”?
If admin consent has already been granted and users continue receiving prompts:
Ensure the user is logging in with their primary Microsoft account (not an alias)
Clear browser cache or try Incognito mode
Verify the user is assigned to CloudExtend Identity in Entra
Make sure Conditional Access Policies are not blocking app consent
If issues persist:
💬 Chat with us using the icon in the lower-right
📧 Email cloudextend-support@celigo.com