Connecting Microsoft 365 (Outlook)

Connect your Microsoft 365 mailbox, calendar and contacts to Mployr - and what to do when Microsoft says your organisation has to approve it first.

What the connection does

Once Microsoft 365 is connected, Mployr can:

Mployr connects through Microsoft Graph using modern OAuth sign-in. It never asks for or stores your Microsoft password, and it works normally with multi-factor authentication and Security Defaults switched on.

Older username-and-password SMTP or IMAP sign-in no longer works for most Microsoft 365 tenants - Microsoft's Security Defaults disable basic authentication across the whole organisation. Connecting with Microsoft is the supported path.

Where to connect from

There are three connection points, and they do different jobs.

All three use the same Microsoft sign-in, and all may need the same one-off approval from your Microsoft 365 administrator.

Connecting your mailbox

1. Sign in with your Microsoft 365 work account. When you connect a new mailbox, Microsoft asks which account to use, so a second mailbox doesn't replace the first.

If step 4 shows an approval message instead of an Accept button, work through the next section.

When Microsoft says approval is required

Many organisations don't let staff approve apps for themselves. When that's the case, Microsoft stops the sign-in and shows one of the following:

Nothing is broken, and there is nothing wrong with your account or your Mployr licence. Microsoft is asking someone with administrator rights over your Microsoft 365 tenant to approve Mployr once, for the whole organisation. After that, you and your colleagues can connect without ever seeing the message again.

Who can approve

Someone in your organisation who holds one of these Microsoft Entra roles - in a small business this is usually whoever manages your Microsoft 365 subscription, and very often your external IT provider:

• Global Administrator
• Privileged Role Administrator
• Cloud Application Administrator
• Application Administrator

If you don't know who that is, your IT support desk will.

Before your administrator approves: one warning

Granting organisation-wide approval replaces whatever approval already existed for Mployr in your directory - Microsoft's own documentation warns that it "may revoke permissions that have already been granted".

In practice that means: if colleagues have already connected their mailboxes, approving a narrower set of permissions than Mployr needs will break their existing connections. Their mail and calendar stop syncing, usually within the hour.

Use the approval link in Option 1 exactly as written. It requests Mployr's full permission set, so it can only ever widen what is approved. Don't approve Mployr from a link you've assembled yourself, and don't use the Grant admin consent button in the Entra admin center unless Mployr's full permission list is already registered against the app there - both can approve less than Mployr needs.

If connections do break, they're recoverable: each person reconnects from wherever they connected - Settings → Integrations for their own mailbox - which re-approves the right permissions.

Option 1: Send your administrator the approval link

This is the quickest route, and the administrator does not have to connect a mailbox or touch Mployr at all.

Send your administrator this link - all one line:

https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=d5cd3b26-ac71-4308-b59a-c5dab9e69cee&scope=https://graph.microsoft.com/User.Read%20https://graph.microsoft.com/Mail.ReadWrite%20https://graph.microsoft.com/Mail.ReadWrite.Shared%20https://graph.microsoft.com/Mail.Send%20https://graph.microsoft.com/Mail.Send.Shared%20https://graph.microsoft.com/Calendars.ReadWrite%20https://graph.microsoft.com/Contacts.ReadWrite%20https://graph.microsoft.com/Files.ReadWrite.All%20offline_access&redirect_uri=https://api.mployr.com.au/oauth/outlook/callback&state=adminconsent

Your administrator then:

1. Opens the link in a browser and signs in with their Microsoft 365 administrator account.
2. Reviews the permissions Mployr is asking for.

That's it. The approval applies to your whole organisation, and they'll land on an Mployr page confirming it worked. They don't need an Mployr account to do any of this.

That link spells out every permission Mployr needs, which is why it's safe to re-run and why it can't approve less than Mployr requires. It is not a sign-in and does not connect a mailbox - it only tells Microsoft that Mployr is allowed in your organisation.

To confirm it worked, your administrator can go to entra.microsoft.com and browse to Entra ID → Enterprise apps → All applications. Mployr will now be listed, with Application ID d5cd3b26-ac71-4308-b59a-c5dab9e69cee.

Option 2: Your administrator connects from inside Mployr

Use this if your administrator also wants their own mailbox connected, or prefers to see exactly what Mployr does with the connection.

Ticking that box approves Mployr for everyone, not just for them. Their own mailbox is connected at the same time, privately; if that isn't wanted, they can disconnect it in Mployr afterwards and the organisation-wide approval stays in place.

This route approves the permissions for connecting Outlook mailboxes - mail, calendar and contacts. If your organisation will also connect shared mailboxes or OneDrive, or read Teams transcripts for Meeting Notes, use the link in Option 1, which names every permission. And if Mployr has already been approved with the Option 1 link, re-run that link rather than approving again this way.

Option 3: Request approval from the Microsoft prompt

If your organisation has Microsoft's admin consent workflow switched on, the Approval required screen includes a justification box.

1. Type a short reason - for example, "Connecting our Microsoft 365 mailbox to Mployr for HR email and calendar."

You'll be notified by Microsoft when it's approved. If nothing happens within a day or so, your organisation probably doesn't have this workflow enabled - use Option 1 instead.

After approval

Go back to where you were connecting - Settings → Integrations or Email → Accounts - and connect again. The Microsoft sign-in will now complete straight through to Accept, and Mployr will show the connection as Connected.

Mail, calendar and contacts sync automatically from that point. The first sync can take a few minutes.

What Mployr asks Microsoft for

Every permission is delegated, which means Mployr can only ever reach what the signed-in person can already reach themselves. Mployr never gets blanket access to other people's mailboxes, and there is no application-level or tenant-wide mailbox access.

Connecting an Outlook mailbox (under Settings → Integrations) asks for:

Connecting a mailbox doesn't ask for your files. The separate OneDrive integration asks to read and write files you can access, for document storage in OneDrive and SharePoint.

A sending account under Email → Accounts asks for much less: sign-in and profile, send mail, and maintain access - plus read and write your mail while Sync this inbox into My Mailbox is ticked. None of those needs an administrator.

The one exception is a shared mailbox - an address like accounts@ that you reach through your own login rather than signing in as. Sending as one needs an extra Microsoft permission that does require administrator approval, so it's a tick-box on the connect screen ("It's a shared mailbox - I'll sign in as myself (Send As / Full Access)"). With Sync this inbox ticked as well, Mployr also asks to read and write mail in mailboxes shared with you, and reads only that shared mailbox - never your own. Leave it unticked unless you need it.

Teams meeting transcripts

Microsoft asks a Microsoft 365 administrator to approve transcript access once for your organisation, so you may see Need admin approval - ask your administrator to approve it, or contact Mployr support for a transcript approval link. Transcription also has to be switched on in the meeting itself (More → Record and transcribe → Start transcription).

Once the connection can read transcripts, Write notes automatically in the Meeting Notes settings writes notes after the Teams meetings you organise.

Removing access

You can disconnect at any time: select Configure on the Outlook connection under Settings → Integrations (the Business side for a shared mailbox) and choose Disconnect, or open the email account under Email → Accounts and choose Disconnect on its Microsoft card. Mployr stops syncing immediately and discards the stored access.

To revoke the organisation-wide approval as well, an administrator removes Mployr under Entra ID → Enterprise apps → All applications → Mployr → Properties → Delete.

Troubleshooting

An administrator has to approve Mployr for your organisation. Work through the options above.

Your organisation may require users to be assigned to the app. An administrator should check Entra ID → Enterprise apps → Mployr → Properties; if Assignment required is set to Yes, they need to assign the relevant users or groups under Users and groups.

A Conditional Access policy is blocking the sign-in - commonly a device compliance, location or approved-app rule. Your administrator will need to allow the sign-in or add an exclusion.

The email account is still set to username-and-password SMTP. Open Email → Accounts, open the account with Edit Settings, and connect it with Connect Microsoft so it sends through Microsoft 365 rather than SMTP.

Two things are needed. In Mployr, reconnect the account with the shared-mailbox box ticked on the connect screen - that asks Microsoft for the extra permission. In Microsoft 365, the person who connected it needs Exchange Send As or Send on Behalf rights on that mailbox, which your administrator grants in the Microsoft 365 admin centre.

Reading a shared mailbox needs Exchange Full Access on it - Send As alone lets you send but not read. Ask your administrator to grant Full Access in the Microsoft 365 admin centre, wait a few minutes for it to take effect, then open the account under Email → Accounts, select Sync inbox and sign in again.

To sync an account's inbox you must sign in as that mailbox itself, or use the shared-mailbox option above. If you signed in as a different mailbox, Mployr keeps sending but won't read it into My Mailbox - reconnect signed in as the right mailbox.

An organisation-wide approval replaces the previous one, so approving a narrower set of permissions than Mployr needs will cut off connections that were working. Re-run the approval link in Option 1 above - it names the full set - then each person reconnects from wherever they connected (Settings → Integrations for their own mailbox). Nothing that was already synced is lost.

Check the connection under Settings → Integrations (the Business side for a mailbox the whole business shares, or Email → Accounts for a sending account - a send-only account never appears). The sync runs on a schedule rather than instantly, and Deleted Items and Junk are deliberately excluded.

If you're stuck, contact Mployr support with the exact wording of the Microsoft message, including any AADSTS code, and we'll tell you exactly what to pass to your IT provider.

For your IT provider

If it's easier to hand this straight to whoever manages your Microsoft 365, the details they need are: