Signing in with Microsoft shows "Need admin approval"

If, after you press the Microsoft button on the login screen, Microsoft’s screen shows one of the following two messages and you cannot go further, your company’s Microsoft 365 is set so that employees cannot approve apps by themselves. Once a Microsoft 365 admin approves Subel for the whole company, you can sign in.

• “Need admin approval” (on a Japanese screen, 「管理者の承認が必要」. AADSTS90094)
• “Approval required” (on a Japanese screen, 「承認が必要」. AADSTS90095)

If you see AADSTS50105 (The signed in user is not assigned to a role for the application), approval is not what you need. Your admin has to add you as a Subel user. Ask your admin to follow Add users.

What the person signing in does

1. Send the URL of this page to your company’s Microsoft 365 admin (such as your IT staff), and ask them to approve Subel.
2. When the approval is done, open https://app.subel.ai again. If you do not have a Subel account yet, press “Start for free” and sign up with the Microsoft button. If you have an account, press “Already have an account? Sign in” and sign in with the Microsoft button.

If the “Approval required” screen has a button to request approval, you can also write why you use Subel and ask the admin for approval from there.

Sign up with an email address and password

If you do not have a Subel account yet and cannot wait for the approval, open https://app.subel.ai/start, press “Start for free”, and create an account with an email address and password. After that, keep signing in with the email address and password.

If you already signed up with Microsoft (for example, your company later revoked the approval), you cannot sign up again with the same email address. A different email address cannot reach your current organization or data, so wait for your admin’s approval.

The Microsoft 365 admin approves Subel

A Microsoft 365 Global Administrator, Privileged Role Administrator, Application Administrator, Cloud Application Administrator, or AI Administrator does this. A custom role that has permission to grant permissions to applications also works. If someone without one of these roles opens the link, Microsoft shows them the same “Need admin approval” screen that the person signing in saw.

1. Open Approve Subel for the whole company. If someone from an outside company manages your company’s Microsoft 365 as a guest, do not click the link. Copy the URL below, replace organizations with your company’s domain (for example, example.co.jp), and paste it into the browser’s address bar.

   https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=5140726e-7a46-4bc5-9fd0-311cdc4f5372&scope=openid%20profile%20email%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&redirect_uri=https%3A%2F%2Fdocs.subel.ai%2Fen%2Ftroubleshooting%2Fmicrosoft-admin-approval%2F

2. Sign in to Microsoft with the admin account.

3. On the “Permissions requested” screen, check the permissions Subel asks for, and press “Accept”. “unverified” appears under Subel’s name, because Subel has not finished Microsoft’s publisher verification yet.

4. After you press “Accept”, this page opens again. If the address bar has admin_consent=True and no error=, the approval is done. Ask the person signing in to sign in again from the start to confirm. If they still see the same screen, the approval did not go to the right organization, or it was cancelled.

Subel asks only to sign you in and read your basic profile, and to read your email address (Microsoft Graph openid, profile, email, and User.Read). Subel uses only your name and email address. On the approval screen, these appear together as one line, “Sign in and read user profile”. The other line, “Maintain access to data you have given it access to”, is shown by Microsoft on the approval screen of every app, and is not an extra permission that Subel asks for.

Add users

If Subel’s “Assignment required?” is set to “Yes”, an admin must add the people who use Subel, or they still see AADSTS50105 after the approval. Open Subel in “Enterprise applications” and add the people or groups in “Users and groups”.

Other ways to approve

• If Subel is in “Enterprise applications” in the Microsoft Entra admin center, you can also approve it from “Grant admin consent for (your organization name)” in Subel’s “Permissions”. Subel is in the list when, for example, someone in your company approved Subel before.
• If you allow people to ask for admin approval, approve the request from Subel in “Admin consent requests” in “Enterprise applications”.