Connecting Microsoft 365 (Outlook)

Connect your Microsoft 365 mailbox, calendar and contacts to mployr — and what to do when Microsoft says your organisation has to approve it first.

What the connection does

Once Microsoft 365 is connected, mployr can:

mployr connects through Microsoft Graph using modern OAuth sign-in. It never asks for or stores your Microsoft password, and it works normally with multi-factor authentication and Security Defaults switched on.

Older username-and-password SMTP or IMAP sign-in no longer works for most Microsoft 365 tenants — Microsoft's Security Defaults disable basic authentication across the whole organisation. Connecting with Microsoft is the supported path.

Where to connect from

There are two connection points, and they do different jobs.

Both use the same Microsoft sign-in, and both may need the same one-off approval from your Microsoft 365 administrator.

Connecting your mailbox

1. Sign in with your Microsoft 365 work account.

If step 4 shows an approval message instead of an Accept button, work through the next section.

When Microsoft says approval is required

Many organisations don't let staff approve apps for themselves. When that's the case, Microsoft stops the sign-in and shows one of the following:

Nothing is broken, and there is nothing wrong with your account or your mployr licence. Microsoft is asking someone with administrator rights over your Microsoft 365 tenant to approve mployr once, for the whole organisation. After that, you and your colleagues can connect without ever seeing the message again.

Who can approve

Someone in your organisation who holds one of these Microsoft Entra roles — in a small business this is usually whoever manages your Microsoft 365 subscription, and very often your external IT provider:

• Global Administrator
• Privileged Role Administrator
• Cloud Application Administrator
• Application Administrator

If you don't know who that is, your IT support desk will.

Before your administrator approves: one warning

Granting organisation-wide approval replaces whatever approval already existed for mployr in your directory — Microsoft's own documentation warns that it "may revoke permissions that have already been granted".

In practice that means: if colleagues have already connected their mailboxes, approving a narrower set of permissions than mployr needs will break their existing connections. Their mail and calendar stop syncing, usually within the hour.

Use one of the two approval routes below exactly as written. Both request mployr's full permission set, so they can only ever widen what is approved. Don't approve mployr from a link you've assembled yourself, and don't use the Grant admin consent button in the Entra admin center unless mployr's full permission list is already registered against the app there — both can approve less than mployr needs.

If connections do break, they're recoverable: each person reconnects from Business → Integrations → Outlook → Connect, which re-approves the right permissions.

Option 1: Send your administrator the approval link

This is the quickest route, and the administrator does not have to connect a mailbox or touch mployr at all.

Send your administrator this link — all one line:

https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=d5cd3b26-ac71-4308-b59a-c5dab9e69cee&scope=https://graph.microsoft.com/User.Read%20https://graph.microsoft.com/Mail.ReadWrite%20https://graph.microsoft.com/Mail.Send%20https://graph.microsoft.com/Mail.Send.Shared%20https://graph.microsoft.com/Calendars.ReadWrite%20https://graph.microsoft.com/Contacts.ReadWrite%20https://graph.microsoft.com/Files.ReadWrite.All%20offline_access&redirect_uri=https://api.mployr.com.au/oauth/outlook/callback&state=adminconsent

Your administrator then:

1. Opens the link in a browser and signs in with their Microsoft 365 administrator account.
2. Reviews the permissions mployr is asking for.

That's it. The approval applies to your whole organisation, and they'll land on an mployr page confirming it worked. They don't need an mployr account to do any of this.

That link spells out every permission mployr needs, which is why it's safe to re-run and why it can't approve less than mployr requires. It is not a sign-in and does not connect a mailbox — it only tells Microsoft that mployr is allowed in your organisation.

To confirm it worked, your administrator can go to entra.microsoft.com and browse to Entra ID → Enterprise apps → All applications. mployr will now be listed, with Application ID d5cd3b26-ac71-4308-b59a-c5dab9e69cee.

Option 2: Your administrator connects from inside mployr

Use this if your administrator also wants their own mailbox connected, or prefers to see exactly what mployr does with the connection.

Ticking that box approves mployr for everyone, not just for them. Their own mailbox is connected at the same time; if that isn't wanted, they can disconnect it in mployr afterwards and the organisation-wide approval stays in place.

Option 3: Request approval from the Microsoft prompt

If your organisation has Microsoft's admin consent workflow switched on, the Approval required screen includes a justification box.

1. Type a short reason — for example, "Connecting our Microsoft 365 mailbox to mployr for HR email and calendar."

You'll be notified by Microsoft when it's approved. If nothing happens within a day or so, your organisation probably doesn't have this workflow enabled — use Option 1 instead.

After approval

Go back to Business → Integrations (or Email → Accounts) and select Connect again. The Microsoft sign-in will now complete straight through to Accept, and mployr will show the connection as Connected.

Mail, calendar and contacts sync automatically from that point. The first sync can take a few minutes.

What mployr asks Microsoft for

Every permission is delegated, which means mployr can only ever reach what the signed-in person can already reach themselves. mployr never gets blanket access to other people's mailboxes, and there is no application-level or tenant-wide mailbox access.

The full Outlook integration asks for:

The send-only connection on an email account asks for much less: sign-in and profile, send mail, and maintain access. None of those needs an administrator, so anyone can connect their own mailbox under Email → Accounts without involving IT.

The one exception is a shared mailbox — an address like accounts@ that you reach through your own login rather than signing in as. Sending as one needs an extra Microsoft permission that does require administrator approval, so it's a tick-box on the connect screen ("This is a shared mailbox I'll sign in to as myself"). Leave it unticked unless you need it.

Removing access

You can disconnect at any time from Business → Integrations → Outlook → Disconnect, or from the email account's Microsoft card. mployr stops syncing immediately and discards the stored access.

To revoke the organisation-wide approval as well, an administrator removes mployr under Entra ID → Enterprise apps → All applications → mployr → Properties → Delete.

Troubleshooting

An administrator has to approve mployr for your organisation. Work through the options above.

Your organisation may require users to be assigned to the app. An administrator should check Entra ID → Enterprise apps → mployr → Properties; if Assignment required is set to Yes, they need to assign the relevant users or groups under Users and groups.

A Conditional Access policy is blocking the sign-in — commonly a device compliance, location or approved-app rule. Your administrator will need to allow the sign-in or add an exclusion.

The email account is still set to username-and-password SMTP. Open Email → Accounts, select the account, and connect it with Connect Microsoft so it sends through Microsoft 365 rather than SMTP.

Two things are needed. In mployr, reconnect the account with the shared-mailbox box ticked on the connect screen — that asks Microsoft for the extra permission. In Microsoft 365, the person who connected it needs Exchange Send As or Send on Behalf rights on that mailbox, which your administrator grants in the Microsoft 365 admin centre.

An organisation-wide approval replaces the previous one, so approving a narrower set of permissions than mployr needs will cut off connections that were working. Re-run the approval link in Option 1 above — it names the full set — then each person reconnects from Business → Integrations → Outlook → Connect. Nothing that was already synced is lost.

Check the connection under Business → Integrations → Outlook. The sync runs on a schedule rather than instantly, and Deleted Items and Junk are deliberately excluded.

If you're stuck, contact mployr support with the exact wording of the Microsoft message, including any AADSTS code, and we'll tell you exactly what to pass to your IT provider.

For your IT provider

If it's easier to hand this straight to whoever manages your Microsoft 365, the details they need are: