Approve MailCraft in your Microsoft directory

When someone signs in to MailCraft with a work or school account, Microsoft’s page may say Need admin approval. This page explains why, what MailCraft asks for, and how to approve it once for everyone.

Why approval is needed

Your organisation lets only an administrator approve a new program’s access to Microsoft 365, and MailCraft’s publisher isn’t verified by Microsoft yet. Until it is, an administrator in each organisation has to approve MailCraft once. Nothing is wrong with the person’s account or password.

Outlook.com, Hotmail, Live and MSN accounts are personal accounts. They have no administrator and never need this.

MailCraft never sees passwords. People sign in on Microsoft’s own page in their browser, and MailCraft receives a sign-in that Microsoft can withdraw at any time.

Approve it

1. When Microsoft’s page says Need admin approval, MailCraft shows Your organisation has to approve MailCraft first.
2. If you’re the administrator, choose I’m an administrator: approve it for my organisation. If you’re not, choose Copy a message for my administrator and send it to them. The message has the link they need.
3. Sign in with an account that can grant consent for the organisation, such as a Global Administrator or Privileged Role Administrator.
4. Check the permissions listed, then choose Accept.
5. Your browser may then show a page that can’t be reached. That’s expected: it’s an address on your own computer where nothing is listening, and the approval has been given by then. MailCraft shows Your organisation has approved MailCraft.
6. Ask the person to choose Try again. Microsoft now lets them sign in.

The approval link has this form, with your organisation’s ID or domain in place of {tenant}:

https://login.microsoftonline.com/{tenant}/v2.0/adminconsent?client_id=9d3f1e86-4dc3-4061-a8b9-00d51c0bdaa5&…

Nothing about the person who asked is in the link.

What MailCraft asks for

MailCraft’s application (client) ID is 9d3f1e86-4dc3-4061-a8b9-00d51c0bdaa5. All permissions are delegated: MailCraft acts only as the person who signed in, and only on their own computer.

Permission	Why
Mail.ReadWrite	Keep the mailbox in step through Microsoft Graph: read mail, and move, flag and delete it.
Mail.Send	Send mail as the person who signed in.
Calendars.ReadWrite	Show the calendar and make, move and answer meetings.
Contacts.Read	Bring contacts down to the computer.
MailboxSettings.Read	Working hours and the category list.
IMAP.AccessAsUser.All, SMTP.Send	Only for accounts set up as Mail only, which use IMAP and SMTP instead of Graph.
offline_access, openid, profile, email	Stay signed in, and know which account signed in.
MailboxConfigItem.Read, Mail.ReadBasic	Only if someone turns on Outlook’s Favourites in the folder pane. Asked for separately, never at sign-in.
Mail.ReadWrite.Shared, Mail.Send.Shared, Calendars.ReadWrite.Shared	Shared mailboxes. Being tested, not yet available to Owners.

The approval covers all of these at once, so nobody is asked again later.

Take it back

To withdraw approval, open the Microsoft Entra admin centre, go to Enterprise applications, find MailCraft, and delete it or remove its permissions. Each person can also remove MailCraft from their own account at myapps.microsoft.com.

Using your own app registration

If your organisation would rather use its own Entra app registration, MailCraft can use another client ID. Set it in File › Options › Microsoft application ID, or per account under Application (client) ID and Tenant in the account’s settings. The app registration needs to be a public client with the redirect URI http://localhost and the delegated permissions above.