--- title: "Fix Outlook \"Need Admin Approval\" (AADSTS90094) Error" description: "Connect Outlook or Microsoft 365 to Prosyo and fix \"Need admin approval\", AADSTS90094 and AADSTS65001 by granting admin consent in Microsoft Entra." url: "https://prosyo.com/docs/connect-accounts/outlook-microsoft-365/" image: "https://prosyo.com/wp-content/uploads/2026/10/Prosyo-wordmark-white-vector.svg" language: "lb" --- # Fix Outlook "Need Admin Approval" (AADSTS90094) Error 1. [Prosyo Docs](https://prosyo.com/lb/docs/) 2. [Connect your accounts](https://prosyo.com/lb/docs/connect-accounts/) 3. Connect Outlook / Microsoft 365 Last updated November 6, 2026 5 min read **On this page** - Who can connect one - Connect - Error: "Need admin approval" - Option A: Ask for approval from the error screen - Option B: Your admin grants consent in Microsoft Entra - Option C: Allow users to consent to this kind of app - Still blocked after consent? - Alternative: connect with SMTP/IMAP - Good habits - Disconnect Connect an Outlook.com or Microsoft 365 work mailbox with Microsoft sign-in. Prosyo sends your email steps from it and syncs replies into your Inbox. ## Who can connect one# Gmail and Outlook connect on a paid plan with an email seat, or with an extra LinkedIn/email seat: - **Multichannel:** your plan's email seat. It holds one mailbox, Gmail/Outlook or SMTP/IMAP, whichever you connect. - **Agency / Team:** one email seat per billed seat, each holding one mailbox. - **Enterprise** and **Penny SDR All-in:** the plan's email seats. - **Extra LinkedIn/email seats**, bought on **Settings → Billing** on Multichannel, Agency / Team and AppSumo plans. Each one holds a Gmail/Outlook mailbox or a LinkedIn account. (AppSumo tiers 5 and 6 include Gmail/Outlook for the first 30 days.) Starter and the Starter trial don't include Gmail/Outlook. During the trial you can use its one [custom SMTP/IMAP mailbox](https://prosyo.com/lb/docs/connect-accounts/smtp-imap/) instead. Paid Starter is LinkedIn-only. Owners, admins and members can connect an Outlook account. Owners and admins see every account. Members and viewers see only their own: the accounts they connected or that were assigned to them. Viewers can't connect or change accounts. Upgrade On Starter, move to Multichannel or Agency / Team to connect Outlook. On an AppSumo plan, or for more mailboxes on Multichannel or Agency / Team, add an extra LinkedIn/email seat. [See plans](https://prosyo.com/lb/docs/billing/plans-and-pricing/). ## Connect# 1. Go to **Settings → Accounts**. 2. In the **Gmail / Outlook** card, click **Connect account** (or **Connect another mailbox** if you already have one), then choose **Outlook** in the connection window. 3. Sign in with the Microsoft account you want to send from. 4. Review the permissions and click **Accept**. 5. You're returned to **Settings → Accounts**. The mailbox shows **Connecting**, then **Healthy**. If the card shows **Purchase extra seat** instead, your email seats are all in use (an SMTP/IMAP mailbox uses one too). **Upgrade to unlock** means your plan has no email seat, and **Choose a plan** means the workspace has no paid plan right now (for example a trial without autopay, or a plan that has ended). Personal Outlook.com, Hotmail and Live accounts usually connect straight away. Work and school accounts may need an admin to approve the app first, as described below. If you cancel or the sign-in fails, **Settings → Accounts** says "Your mailbox wasn't connected". Fix the cause below, then try again. --- ## Error: "Need admin approval"# Most Microsoft 365 organizations only let admins approve apps that read and send mail. If yours does, you'll see a screen like this instead of the permission prompt: > **Need admin approval** [App name] needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it. You may also see an error code: | Code | Meaning | | --- | --- | | `AADSTS90094` | Admin consent is required for the permissions requested | | `AADSTS65001` | The user or administrator has not consented to use the application | | `AADSTS900971` / `AADSTS50020` | You signed in with the wrong account type or tenant. Try again with your work account. | **Before you close the error, write down:** 1. The **app name** shown on the screen. 2. The **Application (client) ID**. Click **Show details** or **Having trouble? → Details** on the Microsoft screen to see it. Your admin needs these to find the app. ### Option A: Ask for approval from the error screen# If the screen shows a **Request approval** button, fill in why you need it (for example "Sales outreach via Prosyo") and click **Request approval**. Your admin gets an email. Once they approve it, go back to Prosyo and click **Connect account → Outlook** again. ### Option B: Your admin grants consent in Microsoft Entra# A **Global Administrator**, **Cloud Application Administrator** or **Application Administrator** does this: 1. **Trigger the app once.** Ask the user to try connecting in Prosyo so the app is registered in your tenant. Or the admin can try connecting themselves. 2. Sign in to the **Microsoft Entra admin center** at [https://entra.microsoft.com](https://entra.microsoft.com). 3. Go to **Identity → Applications → Enterprise applications → All applications** (in newer versions of the admin center: **Entra ID → Enterprise apps**). 4. Search for the **app name** or **Application (client) ID** from the error message and open it. 5. Go to **Security → Permissions**. 6. Click **Grant admin consent for [your organization]**. 7. Sign in with the admin account and click **Accept**. 8. Ask the user to go back to Prosyo and click **Connect account → Outlook** again. If the app doesn't appear in step 4, the admin can sign in to Prosyo, start the Outlook connection themselves, and tick **Consent on behalf of your organization** on the permission screen before clicking **Accept**. ### Option C: Allow users to consent to this kind of app# If your organization wants users to connect approved mail apps on their own: 1. In **Microsoft Entra admin center**, go to **Identity → Applications → Enterprise applications → Consent and permissions → User consent settings** (in newer versions of the admin center: **Entra ID → Enterprise apps → Consent and permissions → User consent settings**). 2. Choose **Allow user consent for apps from verified publishers, for selected permissions** (or the policy your security team prefers). This is an organization-wide change. Most teams should use Option B instead. ### Still blocked after consent?# | Symptom | What to check | | --- | --- | | Error continues after admin consent | Wait 5 to 10 minutes for Microsoft to update, then sign out of Microsoft in your browser and connect again. | | "User assignment required" | In the enterprise app, go to **Properties** and set **Assignment required?** to **No**, or add the user under **Users and groups**. | | Conditional Access blocked sign-in | Your security team must allow the app or your location under **Protection → Conditional Access**. | | Mailbox connects but sending fails | The mailbox needs an Exchange Online license. Shared mailboxes need a licensed user with **Send As** rights. | Tip Forward this page to your IT team. Everything they need is in Option B. --- ## Alternative: connect with SMTP/IMAP# If your organization won't approve the app, a [custom SMTP/IMAP mailbox](https://prosyo.com/lb/docs/connect-accounts/smtp-imap/#microsoft-365--outlook) works only if your admin still allows password sign-in for IMAP and SMTP on that mailbox. Most Microsoft 365 organizations can't. ## Good habits# - Warm up a new mailbox: start near **25 emails per day**. - Make sure SPF, DKIM and DMARC are set for your domain. In Microsoft 365, DKIM is under **Microsoft Defender → Email & collaboration → Policies → Email authentication settings**. ## Disconnect# An owner or admin clicks **Disconnect** next to the mailbox on **Settings → Accounts**. Campaigns that send from it move their prospects to another email account selected in the campaign, or pause until you choose one. Conversations already in your Inbox are kept. You can also remove access at [https://myapps.microsoft.com](https://myapps.microsoft.com) or [https://account.live.com/consent/Manage](https://account.live.com/consent/Manage) for personal accounts. When your plan ends, Prosyo disconnects Outlook mailboxes. After you renew, connect them again. See [When your plan ends](https://prosyo.com/lb/docs/connect-accounts/account-health/#when-your-plan-ends). ## Related guides [Email deliverability Keep cold emails out of spam: set up SPF, DKIM and DMARC, use a secondary domain, warm up mailboxes, cap volume and write emails that land.](https://prosyo.com/lb/docs/help/email-deliverability-guide/) [SMTP/IMAP mailbox Connect any mailbox to Prosyo with SMTP/IMAP. Host and port settings for Google Workspace, Microsoft 365, Zoho, GoDaddy, Hostinger and more.](https://prosyo.com/lb/docs/connect-accounts/smtp-imap/) [Gmail / Google Workspace Connect Gmail or Google Workspace to Prosyo in one click, and fix the "Access blocked" / admin_policy_enforced error in the Google Admin console.](https://prosyo.com/lb/docs/connect-accounts/gmail-google-workspace/) [Multichannel Combine LinkedIn and cold email in one sequence with full copy, conditions and deliverability tips to reach prospects where they answer.](https://prosyo.com/lb/docs/playbooks/multichannel/)