Skip to main content

How to fix Microsoft admin consent issues when connecting Hyperproof to SharePoint and prevent wrong-user connections

When a user with limited permissions tries to connect SharePoint to Hyperproof, they encounter the message: “Need admin approval.

Jen Zilin avatar
Written by Jen Zilin
Updated over 2 months ago

If you're trying to connect SharePoint to Hyperproof and see the error “Need admin approval. Hyperproof SharePoint requires permission to access organization resources that only an admin can approve,” this happens because:

  • The Hyperproof SharePoint app isn't created until someone with Microsoft admin rights logs in.

  • Microsoft requires admin consent before allowing any user to access apps that need organization-level permissions.

  • If a non-admin user tries to connect first, Microsoft blocks it since the app hasn’t been registered yet.

How to fix it

Follow these steps to resolve the issue:

  1. Admin performs initial login

  • Have a Microsoft Entra ID administrator (such as a Global Admin, Cloud App Admin, or Application Admin) log into Hyperproof and connect SharePoint.

  • The "Hyperproof SharePoint" app will be created and consented to in your Microsoft tenant during this step.

  • The app will then appear in the Azure Portal under:
    Enterprise Applications → Hyperproof SharePoint.

2. Switch to your service account

  • Once the connection creation is successful, recreate the SharePoint connection using your service account designated for ongoing integrations.

  • Use an incognito/private browsing window or sign out of the SharePoint admin account first to avoid auto-login.

  • Your service account should now connect without triggering the admin approval message.

3. Remove the admin connection to ensure security and prevent confusion

  • In Hyperproof, go to Settings → Connected Apps.

  • Find the admin account’s SharePoint connection.

  • Click the connection → select Disconnect → confirm.

  • This only removes the admin’s connection, not the app itself.

After these steps, your service account will be the active connection used for ongoing data syncs, and no further admin approval should be needed.

Did this answer your question?