Connecting Microsoft 365 in managed tenants (Entra admin guide)

If your organization manages Microsoft 365 centrally through Microsoft Entra (formerly Azure Active Directory), connecting a Microsoft email account to Close can be blocked by your organization’s app consent policies. This guide is written for the Microsoft Entra administrator of your organization.

When to use this guide

Use this guide if users in your organization see one of the following when trying to connect (or reconnect) their Microsoft account in Close under Settings > Accounts & Apps:

• A Microsoft screen titled “Administrator approval required” (in German: “Administratorgenehmigung erforderlich”) saying Close needs permission to access resources that only an admin can grant.
• Failures in the Entra sign-in logs with error 90094: “Admin consent is required for the permissions requested by this application.”

If the account connects fine but disconnects when sending email, that is a different issue; see Office365 connected accounts.

Permissions Close requests

When a user connects a Microsoft account, Close requests the following permissions (scopes):

• Calendars.Read
• Calendars.Read.Shared
• Calendars.ReadWrite
• IMAP.AccessAsUser.All
• Mail.ReadWrite
• Mail.Send
• SMTP.Send
• User.Read
• offline_access
• openid
• profile

The three Calendar permissions are required to complete the connection even if your organization never plans to use calendar syncing. Close requests them as part of a single consent, and Microsoft blocks the whole connection if any of them can’t be granted. Calendar syncing itself can be turned off inside Close afterwards under Settings > Accounts & Apps > your account > Calendar.

Checklist for Entra admins

If a user is blocked, verify the following in the Microsoft Entra admin center:

1. Permissions match the full list. Go to Enterprise Applications > Close > Permissions and confirm every permission listed above has admin consent granted — including the three Calendar permissions. If some are missing from the list entirely, see the next section.
2. User assignment. Go to Enterprise Applications > Close > Properties. If “Assignment required?” is set to Yes, the affected user must be explicitly assigned to the Close app under Users and Groups.
3. Conditional Access. Go to Security > Conditional Access and confirm no policy blocks the affected user from signing in to or consenting to the Close app.

If permissions are missing from the list and won’t update

The permissions list shown in Entra does not refresh on its own. If the permissions Close requests have changed (for example, the Calendar permissions were added), your tenant keeps showing the old list — and clicking “Grant admin consent” can appear to succeed while the missing permissions stay stuck under user consent.

To refresh it, an Entra administrator should go through the Close connection flow once themselves:

1. Sign in to Close and go to Settings > Accounts & Apps > + Add Account > Microsoft.
2. Microsoft will show the current, full set of permissions Close requests.
3. Tick “Consent on behalf of your organization” and accept.

This grants the new permissions org-wide in one step. If a regular (non-admin) user goes through the flow instead, Microsoft files an approval request that the admin can then approve under Enterprise Applications > Admin consent requests — this works too, but adds a round trip.

If reconnecting still fails

If a previously connected account keeps failing even after consent is fixed, don’t use the Reconnect button. Instead, remove the account entirely (Settings > Accounts & Apps > your account > Remove Account) and re-add it via + Add Account > Microsoft. This forces Close to request a fresh set of access tokens. No synced data is lost when removing an account.

What Close can and can’t see

When a consent screen is abandoned or blocked, Microsoft doesn’t tell Close why, Close only receives a generic “flow canceled” response. The diagnosis for these failures happens in your Entra sign-in logs, not in Close. If you contact support@close.com about a blocked connection, including the error code, correlation ID, timestamp, and the affected user’s sign-in name (UPN) from the sign-in logs will speed things up considerably.