Why Does This App Need Admin Approval? SharePoint

TL;DR: "Need admin approval" means the app you tried to connect asked Microsoft for permissions that reach beyond your own files, and Microsoft only lets a tenant administrator grant those. SharePoint triggers it because its permissions cover other people's sites, not just yours. The fix is a one-time admin consent: send your IT admin the approval link, the permissions in plain language, and a short justification, and they approve once for the whole organization.

You click Connect SharePoint, sign in with your work account, and instead of an Accept button you get a grey box: "Need admin approval. This app needs permission to access resources in your organization that only an admin can grant." There is nothing to click except a link to sign in with an admin account you do not have.

Nothing is broken and you did nothing wrong. Microsoft is telling you that this decision belongs to someone else. The screen just does not say why, or what to do next. Admin consent is a one-time approval by a Microsoft 365 administrator that allows an application to act on the organization's data on behalf of its users, inside each user's existing permissions.

What does "Need admin approval" mean?

It means the app requested at least one permission that Microsoft classifies as reaching beyond your personal data, and your organization's settings do not let individual users grant that kind of permission on their own.

Every app that signs in with a Microsoft 365 account declares what it wants to do: read your profile, read your mail, read files in SharePoint sites. Microsoft Entra, the identity service behind Microsoft 365, sorts those requests into two groups. Low-impact permissions touch only the signed-in user's own data, and most organizations let users accept those themselves. Higher-impact permissions reach data that belongs to the organization or to other people, and those need an administrator. Tenant settings matter too: an administrator can turn user consent off entirely, in which case almost every third-party app shows this screen.

The message is not a security verdict on the app, and it is not a permanent refusal. It is a routing decision: the request goes to an administrator instead of to you.

That is the difference between user consent and admin consent. User consent grants an app access to your data only, and is recorded per-user. Admin consent is granted on behalf of the organization and is tenant-wide: every user can then sign in without seeing a consent screen. SharePoint tips over the line because a document library on the Finance site belongs to the organization, not to you. The app still acts as you and cannot open anything your account cannot open, but the permission is written in terms of the organization's sites, so Microsoft sends it to an administrator.

What does an administrator evaluate before approving?

Four things: who publishes the app, exactly which permissions it asks for, whether the grant is per-user or tenant-wide, and how the vendor handles the data it can reach.

Publisher. The consent screen shows the publisher and whether Microsoft has verified it. Many organizations block unverified publishers by policy.

Permissions, one at a time. Each carries a plain-language description. Does the app need to write, or only read? Does it act as the signed-in user, bounded by that user's access, or on its own with no user present? The second kind gets far more scrutiny, because nobody's site permissions limit it.

Scope of the grant. Approval is tenant-wide, so the admin weighs whether every user should be able to connect or whether to assign the app to a smaller group first.

Data handling. Where does the vendor store what it reads, and for how long? Does it read document contents or only names and dates? Is there a privacy policy? Requests that arrive with these answers get approved faster.

How to request admin consent from your IT admin

If your organization has turned on Microsoft Entra's admin consent request workflow, the "Need admin approval" screen itself has a box for a justification and a Request approval button. If not, you send the approval link and the permissions to your admin through a ticket or email.

With the workflow on: you type why you need the app and submit. The reviewers your organization designated get an email. They open the request in the Microsoft Entra admin center, see the app, its publisher, every permission, and who asked, then approve for the whole organization, deny, or block future requests. You get an email with the outcome. Unreviewed requests expire after a period the organization sets.

Without the workflow, the URL in your browser's address bar on that screen is the approval link. An administrator who opens it, signs in, ticks "Consent on behalf of your organization," and accepts has done the entire job.

Either way, a good request names the app, lists each permission in plain language with its reason, describes one concrete use, and says what the app will not do. Here is one to paste and adjust.

Subject: Admin consent request: The Drive AI for SharePoint (Finance site, Accounts Payable library)

Hi Tom,

I tried to connect The Drive AI to SharePoint and got the "Need admin approval" screen. The app asks to read and update files in SharePoint sites on my behalf, which only a tenant admin can grant.

What I want it for: one workflow on the Accounts Payable library on the Finance site. When an invoice arrives, it files it under the vendor and renames it by vendor, invoice number, and date. Anything over $5,000 waits for Dana to approve.

What it does not do: it acts as me, so it cannot open any site I cannot already open. Only the library named in the workflow is watched.

Approval link: [paste the URL from the "Need admin approval" page]
Vendor details: thedrive.ai/integrations/sharepoint

Happy to pilot on this one library and review the activity log with you in two weeks.

Thanks,
Priya

Do other SharePoint tools need admin approval too?

Anything built by Microsoft runs inside the tenant and never shows the third-party consent screen. Anything from an outside vendor does, and whether you or an administrator can accept it depends on your tenant's consent settings.

Option	Who approves	What is approved	Acts on
Manual filing in SharePoint	Nobody extra; your own site permissions	Nothing new	Whatever you read yourself
SharePoint views, metadata columns, retention labels	Site owner or admin	Site settings, not app access	Column values, not document text
Microsoft Power Automate	Microsoft's own service; licensing and admin policies, not a consent screen	Connections under your own credentials	Metadata and columns, unless AI Builder is added
Zapier or Make	Tenant consent settings decide: you or an admin	Third-party app permissions	Filenames and metadata, unless an AI step is chained
The Drive AI Workflows	A tenant administrator, once for the organization	Third-party app permissions, bounded by your SharePoint access	What the document says, in place in the library

If routing by column values is enough, Power Automate needs no outside approval. The consent screen is worth crossing when the automation has to read what a document says.

How The Drive AI handles the approval step

When Microsoft refuses the connect attempt, The Drive AI hands you the approval link, the permissions in plain language, and a request message already written out for a ticket or email. Your administrator approves once for the whole organization. After that, each team member connects their own account without seeing the screen.

Connecting registers nothing. You find a site by name or paste a site URL, then pick one document library. A library is watched only because a workflow names it, and stops being watched when no workflow does. Your existing SharePoint permissions remain the boundary.

A workflow on that library starts from File Uploaded, File Updated, or On a Schedule. You describe it once in plain English, and the steps appear on a canvas, each with a cost badge: free, ai, human, or external. The filing steps are Ask AI About the File, Read Details from File, Move, Rename, and Ask a Person to Approve. Files are renamed and moved in place. Every run is recorded in an activity feed, can be replayed on the canvas, and retried from the step that failed.

Three workflows people build once approval lands:

When a file is uploaded to the Accounts Payable library, if it is an invoice under $5,000, then file it under Vendors, the vendor name, and the year, and rename it to vendor, invoice number, and date. If it is over $5,000, ask Dana Whitfield to approve first.

When a file is uploaded to the Contracts library on the Legal site, if it carries both signatures, then move it to Clients/Northwind/Contracts and rename it to client, agreement type, and signature date. If a signature is missing, ask Marcus Lee to approve first.

Every Sunday at 6 pm, go through every file in the Shared Documents library on the Operations site. If it is a safety certificate, move it to Compliance/Certificates/2026 and rename it to site, certificate type, and expiry date.

The full walkthrough is in SharePoint document library workflows; for a library that is already full, see how to organize SharePoint files automatically. The connection itself is on the SharePoint integration page.

What admin approval does not change

Approval lets the app sign in. It does not widen what you can see, and it does not change how a workflow treats the library.

Your SharePoint permissions still decide what a workflow can reach. If you cannot open a site, neither can a workflow running as you.
Files are renamed and moved in place. Nothing is imported unless the workflow includes a Save a Copy step. Nothing outside the chosen library is touched.
Steps marked ai open the file and read it. They cost a little per file and can occasionally be wrong, so a human step belongs in front of anything consequential.
Ask a Person to Approve waits three days by default and thirty at most. After that the file takes the Expired path; if nothing is connected to it, the file stays put and the expiry is recorded.
SharePoint Online only. On-premises SharePoint Server is not supported.
A file dropped in a Teams channel is a SharePoint file, because a Team's standard channels are folders inside its site. Team libraries are marked in the picker, and a shared upload runs the workflow once. See where Microsoft Teams files go.
Connecting SharePoint needs the Max plan on a personal workspace, or any Team plan.

Setting it up after approval

Wait for the approval email or your admin's confirmation, then retry the connection.
Connect SharePoint with your Microsoft 365 work or school account. Each team member connects their own.
Find the site by name or paste its URL, then pick the one document library you want a workflow on.
Describe the workflow in one sentence and check the canvas: which steps are free, which read the file, and where a person is asked.
Drop one test file into the library and open the activity feed. Confirm it was renamed and moved where you expected before the workflow runs unattended.

The broader pattern, from email attachments to chat files, is in the complete guide to automated document workflows.

Frequently Asked Questions

Why does this app need admin approval when I own the SharePoint site?

Site ownership and app consent are different things. Owning a site lets you decide who reads its files. Consenting to an app is a tenant-level decision, because the permission is written in terms of the organization's sites rather than one site. A site owner cannot grant a permission defined above the site, so it goes to a tenant administrator regardless of your role.

Is "Need admin approval" a sign the app is unsafe?

No. The screen appears for any app that requests permissions beyond a user's own data in a tenant that restricts user consent, whether the publisher is a large vendor or a startup. It says nothing about the app's quality. Verified publisher status, the specific permissions, and the vendor's data handling are the signals that judge safety.

How long does admin consent take?

That depends on your organization, not on Microsoft. With the admin consent request workflow enabled, reviewers get an email the moment you submit, and a complete request is often approved the same day. Without it, the request takes as long as your ticket queue. Naming the app, the permissions, and the one library it will touch moves it fastest.

Does admin consent give the app access to every SharePoint site?

It lets the app sign in on behalf of users across the organization, but the app acts as each signed-in user and can open only the sites and libraries that user can already open. Consent does not add access. With The Drive AI, nothing is watched until a workflow names a specific library, and only that library is touched.

What if my company has no IT department?

Someone still holds the administrator role: usually whoever set up the Microsoft 365 subscription or manages its billing. That person signs in with the admin account, opens the approval link from the "Need admin approval" page, ticks "Consent on behalf of your organization," and accepts. That single action approves the app for everyone in the tenant.

After the approval

The screen that stopped you is a routing step, not a wall. Send the request with the link, the permissions, and the one library you want to start with, and the rest is a single click for your admin. When it lands, build your first workflow on that library, or read how Workflows handle files wherever they live.