Overview
When a user in your organization connects the Supio Outlook integration, Microsoft Entra ID may require an admin to grant consent before access is permitted — governed entirely by your organization's app consent policies. This guide covers both reactive approval (after a user is blocked) and proactive pre-approval (before anyone hits the wall).
What the User Sees
The user sees an "Approval required" prompt at login.microsoftonline.com, listed as Supio Outlook Connector (unverified), and must submit a justification to their IT admin before proceeding.
Permissions Being Requested
The app requests the following delegated Microsoft Graph permissions on behalf of the user:
Permission | Purpose |
Sign in and read your profile ( | Identifies the authenticated user |
Read and send mail, including shared mailboxes ( | Reads and files case-related email into Supio, and sends messages on the user's behalf |
Read and write mailbox settings ( | Keeps mail sync configured correctly |
Read and write calendars, including shared calendars ( | Syncs meetings and deadlines, and lets Supio schedule follow-ups |
Read and write contacts, including shared contacts ( | Syncs client and colleague contacts used across cases |
Read and write tasks ( | Syncs to-dos tied to case work |
Read places ( | Resolves meeting-room/location details on calendar invites |
Read your organization's directory ( | Looks up colleagues for tagging and assignment |
Maintain access to data you've given it ( | Keeps the session active without repeated prompts |
Source: equity-gateway/src/services/outlook.service.ts (SCOPE constant) — confirm this list stays in sync with the code before publishing, since scopes can change.
Approving a Pending Request (Reactive)
Follow these steps once a user has submitted an approval request:
Navigate to the Admin Consent Requests queue. Sign in to the Microsoft Entra admin center (entra.microsoft.com) as a Global or Privileged Role Administrator. Go to: Enterprise Applications → Admin consent requests.
Locate and open the Supio Outlook Connector request. Find the pending request submitted by the user and select it.
Review permissions and grant consent. Select Review permissions and consent, then Accept to grant tenant-wide admin consent. This unblocks the requesting user and all future users in your tenant.
Notify the user. They can reattempt their connection immediately — no further action needed on their end.
Pre-Approving Before Users Are Blocked (Proactive)
An admin can grant consent before any user attempts to connect:
Open Enterprise Applications in Entra. In the Microsoft Entra admin center, go to Enterprise Applications → All applications.
Search for Supio Outlook Connector. Use the search bar to find it by name.
Grant tenant-wide admin consent. Open the app, go to the Permissions tab under Security, and select Grant admin consent for [Your Organization]. Confirm when prompted.
Important: this is your tenant, your policies. The consent requirement is enforced by your own Entra ID app consent policies — not by Supio. If your organization has user consent blocked by policy (common in security-hardened tenants), admin consent is the only path forward.