I’ve updated to the official release of eM Client 11 on macOS. My Microsoft 365 accounts still run over EWS, so I tried re-adding them to switch to MS Graph. On both of my work tenants (a university tenant and a law firm tenant, both strictly managed) the Microsoft sign-in ends with “Needs admin approval” for eM Client. The consent screen offers only “sign in with an admin account” or “return to the app without consent”, so no consent request gets filed automatically.
On one of the tenants the administrator had already approved an admin consent request for eM Client during the beta, and the prompt still appears. My guess is that the consent was granted for a different set of permissions than the release version requests, since the Graph scopes were changed during the beta (see Olivia’s post in Authorisation for eM Client 11 with Graph support).
I went through the release announcement, the EWS retirement article and the forum, but couldn’t find any guidance for administrators. With EWS being blocked since 1 October, I expect many users on managed tenants will hit the same wall, so it would help to have this documented publicly:
Which Application (client) ID does eM Client 11 use for Microsoft Graph? Microsoft’s Entra documentation lists eM Client under ID e9a7fea1-1cc0-4cd9-a31b-9137ca5deedd in its built-in mail client consent policy (microsoft-user-default-allow-consent-apps), which should let users consent to mail permissions themselves. Since that doesn’t help on either of my tenants, is version 11 using a different ID, or requesting permissions outside that policy?
What is the full list of delegated Graph permissions the release version requests?
What is the recommended procedure for admins: tenant-wide admin consent in Entra ID (Enterprise applications → eM Client → Permissions → Grant admin consent), an admin consent URL, or something else?
Does an admin consent granted during the beta need to be granted again?
Are shared/delegated mailboxes (previously added under Exchange Web Services → Delegation → Accounts you can access) supported with Graph, and where are they added now?
I’ve also contacted support, and I’ll post their answer here if it arrives first (so far no response).
Thank you, David. This is extremely useful. I’d been wondering whether to update and to try the switch, following my experiences with the beta where admin approval was needed. I was under the impression there would be an update that would reduce the need for admin approval, but I don’t know if there are options the user can select (?).
Once version 11 is up and running, is it possible for the user to switch between EWS or Graph on the fly? Or do they have to create a new eM Client account from scratch to do that?
Glad it helps. As far as I can tell, the reduced scope Olivia mentioned either didn’t make it into the release or wasn’t enough for strictly managed tenants – I still get the admin approval prompt on both of mine with the release version. I haven’t seen any option on the user side to choose what eM Client requests; the consent screen simply shows whatever the app asks for, so it’s down to the administrator.
As for switching: I haven’t found a per-account toggle between EWS and Graph. The release history mentions a migration wizard from EWS to Graph, and the release announcement says the migration is offered at the first startup after the update. What I did (already during the beta) was add my Microsoft 365 account a second time, which uses Graph. My existing EWS account stayed in place and kept working, so trying Graph this way doesn’t break your current setup – if the sign-in ends with “Needs admin approval”, you just cancel it and carry on with EWS.
Just keep in mind that Microsoft has been blocking EWS for third-party apps since 1 October, so EWS may stop working at some point regardless. That’s why I’d suggest asking your admins sooner rather than later.
I’ll post here once I hear back from eM Client support. Or maybe we will get some response from eM Client team.
I had the same issue, but it appeared only when changing an existing account. So I tried adding the same account a second time (besides the current one) but with graph enabled and it worked fine. I deleted the “old” EWS account afterwards and it still works.
Only downside: you reload the database completely.
Thanks, Bisku – that’s useful to know. I did the same thing (added the account a second time with Graph, keeping the EWS one), but on both of my tenants even the fresh sign-in ends with “Needs admin approval”. So I suspect the difference is in the tenant settings: your tenant probably allows users to consent to apps themselves, while mine block user consent, so an administrator has to approve eM Client.
To be clear, this isn’t just a matter of asking the admin: on one of the tenants the administrator already approved an admin consent request for eM Client (during the beta), and I still end up on the same “Needs admin approval” screen. Most likely the consent was granted for a different set of permissions or a different application than the release version uses. That’s why I need the details from my original post – the Application (client) ID used for Graph and the full list of requested permissions – so the administrators know exactly what to approve.
Hi David,
Thanks for the detailed write-up. We HAVE decreased the scope following the first BETA, but shortly before release, we have added one additional permission back.
I consulted your questions with our devs and got you these answers:
1. Application (client) ID
eM Client 11 uses the same application for Microsoft Graph as it did for EWS: e9a7fea1-1cc0-4cd9-a31b-9137ca5deedd. There’s no separate app for Graph.
2. Delegated Graph permissions requested by the release version
offline_access
openid
email
profile
User.Read
User.ReadBasic.All
MailboxSettings.ReadWrite
Mail.ReadWrite
Mail.ReadWrite.Shared
Mail.Send
Mail.Send.Shared
Calendars.ReadWrite
Calendars.ReadWrite.Shared
Tasks.ReadWrite
Contacts.ReadWrite
ShortNotes.ReadWrite
ShortNotes.ReadWrite was added shortly before the release and wasn’t requested by the beta. Because the request is for more than the built-in mail client consent policy covers, a strictly managed tenant will ask for admin approval even though eM Client is listed in that policy.
3. Recommended procedure for admins
The simplest way is tenant-wide admin consent in Microsoft Entra admin center: Enterprise applications → eM Client → Permissions → Grant admin consent for tenant. The permissions list there shows the current set the app requests.
4. Does consent need to be granted again even if it was granted during beta?
If you encounter this message, then unfortunately yes. Since ShortNotes.ReadWrite was added after the beta, the earlier consent doesn’t cover the full set, which is most likely why the prompt still appears on that tenant. Granting admin consent again (step 3) will fix it.
Also, a heads-up for admins: version 11.1 will most likely add two more permissions, PurviewDrmScope and PurviewSyncScope. These will only be requested on demand (when the related feature is used), not at sign-in.
5. Shared/delegated mailboxes with Graph
Yes, they’re supported. You just needed to right-click the account in the main window and choose Delegation to add the mailbox you have access to. But the setting should be added back to the Accounts window as well, just under MS Graph (the latest update 1267 should have it back already).
Thank you – this is exactly what I needed, and thanks to the devs as well. I’ll pass it on to the administrators of both tenants and report back here once admin consent has been granted, so others on managed tenants know whether it worked.
Thanks again for the detailed answer. Unfortunately it didn’t solve the problem. The administrators of both of my tenants report that they granted tenant-wide admin consent for eM Client (Enterprise applications → eM Client → Permissions → Grant admin consent), yet on both tenants the Graph sign-in still ends with the same “Needs admin approval” screen.
One possible explanation I can think of: “Grant admin consent” in Enterprise applications only covers the permissions statically configured in the app registration. If eM Client 11 requests some scopes dynamically at sign-in (e.g. ShortNotes.ReadWrite, added shortly before the release) and these aren’t part of the app’s published permission list yet, the admin consent wouldn’t include them and users would still be prompted. Could you check with the devs whether all the scopes you listed are in the app registration? And if not, could you provide an admin consent URL with the scopes explicitly listed (the v2.0 adminconsent endpoint with a scope parameter) that the admins could use instead?
Also, is there anything else admins should check – for example, whether a second service principal or a separate resource (Office 365 Exchange Online) is involved?
Hi everyone,
All the permissions should be in-line with what’s configurable via the web interface, so if the Admin can view the app permissions, they should see the whole list.. none of the permissions are requested dynamically.
But our devs have changes the settings on the dveeloper app settings side, can you please try connecting the accounts once more and let us know?
Thanks for looking into it. I’ve just tried adding the account again (26 October, around 13:20 CET) and unfortunately nothing has changed: on both tenants the sign-in still ends with “Needs admin approval”, even though the administrator granted tenant-wide admin consent after your previous post.
Hi David, thank you for the details.
Could the admin perhaps send us a screenshot of the scopes he sees for our app from his view? Please send the screenshot to [email protected] with a link to this forum thread in the body. Thank you!
Thanks, will do. I’ll try to get the screenshot from one of our administrators by the end of the week.
I should say, though, that I’ve already gone back to both admin teams a couple of times over this, and there’s only so much goodwill I can spend before they start screening my emails If there’s anything else your devs might need from the admin side, please let me know now and I’ll ask for everything in one go.
I just wanted to confirm that we have the same issue with a client of ours. I granted all the needed admin permissions but the users still can’t log-in.
Thank you for your help. If you need further information or screenshots of the app-permissions, let me know.
I’m interested too and have been watching this thread. I’ve not tried to connect to my account again yet, but have been presuming there would be no change (i.e. admin intervention would still be required).
The cause was on eM Client’s side: some of the permissions eM Client 11 requests at sign-in (openid, Mail.ReadWrite, Mail.Send, Tasks.ReadWrite, Contacts.ReadWrite) were missing from the app registration in Entra. Because of that, the usual “Grant admin consent” in Enterprise applications couldn’t cover them, and users kept getting “Needs admin approval” even after their admins had approved the app. Our administrator confirmed this by comparing the scopes in the sign-in URL with the permissions approved in Entra.
eM Client support is working on a fix of the app registration. Until then, the workaround is an admin consent link that grants the full set of permissions explicitly: the admin opens it, signs in with an admin account and clicks Accept. After that, adding the account via MS Graph worked for me straight away.
The link from eM Client support:
Many thanks to Olivia, Julie and the devs for sorting this out.
If there’s anything else your devs might need from the admin side, please let me know now and I’ll ask for everything in one go.