Skip to main content

Can’t sign up with Microsoft: “Need admin approval”

Troubleshooting · Microsoft Sign-in

Written by Agent Bob

When you create a new StackBob.ai organization using Sign Up With Microsoft option, the Microsoft sign-in window may show “Need admin approval” instead of signing you in. This happens when your organization doesn't let users sign in to new apps until an admin reviews them. To fix it, a Microsoft Entra ID admin needs to approve the StackBob enterprise application in Entra ID. This needs to be performed only once for whole organization. After that, everyone can sign in with Microsoft.

Symptom

When you select Sign Up With Microsoft option, Microsoft sign-in window shows Need admin approval instead of signing you in:

Selecting Return to the application without granting consent takes you back to StackBob.ai without creating an account.

In some organizations, the screen may be shown as Approval required and has a Request approval button.

Cause

Your organization's Microsoft Entra ID settings stop users from signing in to new apps until an admin reviews them. Until an admin approves StackBob.ai for the organization, nobody can sign up with Microsoft.

StackBob.ai only asks to sign users in and read their own name and email address, with read-only access:

Permission

Purpose

openid

Signs the user in with their Microsoft work account

profile

Reads the user's name

User.Read

Reads the user's own profile, including their corporate email address

offline_access

Microsoft's default permission for the OAuth sign-in (Requested only during OAuth flow)

With these permissions, StackBob.ai can't read any sensitive user data or change anything in your tenant.

Resolution

1. If you're a user

Check which screen Microsoft shows you:

Screen

What to do

Need admin approval (as in the screenshot above)

Your organization doesn't accept requests from this screen. Send this article to your IT or identity team.

Approval required, with a Request approval button

Enter a business reason and select Request approval. You get an email when your organization's Entra ID reviewer responds.

After an admin approves StackBob.ai in your organization's Entra ID, go through Create Your StackBob Org again.

2. If you're an admin

If you're reading this, someone in your organization tried to sign up for StackBob.ai with Microsoft and received a Need admin approval message. In your organization, an Entra ID admin must approve new apps before anyone can use them. To let users sign in to StackBob.ai with their corporate Microsoft accounts, approve StackBob as an enterprise application in Entra ID. For security, StackBob.ai doesn't offer username-and-password sign-in; users sign in only through OAuth with their identity provider.

StackBob.ai is an identity connectivity platform that enables IT and IAM teams to connect disconnected apps through AI-built, human-verified, deterministic automations. StackBob.ai is SOC 2 Type II compliant, and its security controls are independently audited. The Entra ID application you’re asked to approve is named StackBob and is published by Stackoon Corp., the company behind StackBob.ai. Stackoon Corp. is a Microsoft-verified publisher, and the application ID is 725cf15a-58d5-4974-bef0-d24c26d66935.
​

To let your users test the StackBob.ai platform, approve the StackBob enterprise application in Entra ID so they can sign in with their Microsoft account. The app asks only for basic, read-only sign-in permissions: it signs users in and reads their name and email address. It can't access your directory, mail, or files, and it can't change anything in your tenant.

To approve , you need one of these roles: Cloud Application Administrator, Application Administrator, Privileged Role Administrator, or Global Administrator (Learn more at: Microsoft Learn).

You can approve it in one of two ways: with the admin consent link, which opens Microsoft's official OAuth consent screen (Option 1, recommended), or with a PowerShell script (Option 2, if you prefer to manage tenant changes as scripts).

​

Admin Option 1: Use the admin consent link (recommended)

  1. In a private browser window, open the StackBob.ai admin consent link
    ​

    https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=725cf15a-58d5-4974-bef0-d24c26d66935&scope=openid%20profile%20User.Read%20offline_access&redirect_uri=https%3A%2F%2Fapp.stackbob.ai%2Fsignup

  2. Sign in with your admin account.
    ​

  3. Check that the screen shows Permissions requested - StackBob (Stackoon Corp.) with the verified badge, then select Accept.

Microsoft redirects you to StackBob.ai. Everyone in your organization can now sign up with Microsoft.

Admin Option 2: Use PowerShell

This option grants three permissions: openid , profile , and User.Read :

  1. Run this script in Azure Cloud Shell (PowerShell), or in any PowerShell session signed in to Azure with the Microsoft Graph module installed. It adds StackBob to your tenant, if it isn't there yet, and grants the three permissions for all users. If StackBob already has tenant-wide consent, the script updates it to exactly these three permissions.
    ​

    $tenantId = (Get-AzContext).Tenant.Id
    Connect-MgGraph -TenantId $tenantId -UseDeviceCode -Scopes "Application.ReadWrite.All","DelegatedPermissionGrant.ReadWrite.All"

    $stackbobAppId = "725cf15a-58d5-4974-bef0-d24c26d66935"
    $graphAppId    = "00000003-0000-0000-c000-000000000000"
    $scopes        = "openid profile User.Read"

    $stackbob = Get-MgServicePrincipal -Filter "appId eq '$stackbobAppId'"
    if (-not $stackbob) { $stackbob = New-MgServicePrincipal -AppId $stackbobAppId }

    $graph = Get-MgServicePrincipal -Filter "appId eq '$graphAppId'"

    $grant = Get-MgOauth2PermissionGrant -Filter "clientId eq '$($stackbob.Id)' and resourceId eq '$($graph.Id)' and consentType eq 'AllPrincipals'"

    if ($grant) {
      Update-MgOauth2PermissionGrant -OAuth2PermissionGrantId $grant.Id -Scope $scopes
      Write-Host "Updated existing consent for StackBob."
    } else {
      New-MgOauth2PermissionGrant -BodyParameter @{
        ClientId    = $stackbob.Id
        ConsentType = "AllPrincipals"
        ResourceId  = $graph.Id
        Scope       = $scopes
      } | Out-Null
      Write-Host "Granted tenant-wide consent for StackBob."
    }

    ℹ️ Microsoft applies permissions granted by script immediately, without a consent screen (Microsoft Learn). Check the Scope line before you run it.

    ​

  2. In the Microsoft Entra admin center, go to Entra ID > Enterprise apps > All applications > StackBob > Security > Permissions, and confirm that the three permissions appear under Admin consent.

If the problem continues

Problem

Fix

Users still see an approval screen after an admin approved

The admin may have approved StackBob.ai in a different Microsoft organization, for example while signed in with an account from another tenant. Repeat Option 1 with an admin account from your own organization.

Microsoft says you aren't assigned to the app (error AADSTS50105)

Your admin has limited StackBob.ai to specific users. Ask them to add you, or one of your groups in Entra ID, under Enterprise apps > StackBob > Users and groups.

More information

  • Let users request approval for new apps in Entra ID. A Global Administrator can turn this on in Entra ID > Enterprise apps > Consent and permissions > Admin consent settings, by setting Users can request admin consent to apps they are unable to consent to to Yes (Microsoft Learn). The setting applies to every app in your tenant.

  • Limit who can sign in. After approval, every user in your tenant can sign in to StackBob.ai. To limit access, open Enterprise apps > StackBob, set Properties > Assignment required? to Yes, and assign users or groups under Users and groups.

  • Stay in control. StackBob works like any other enterprise application in Entra ID: your Conditional Access policies and sign-in logs apply, and you can manage or remove its access at any time in Enterprise apps > StackBob.

Did this answer your question?