Someone in your organization tried to open one of our apps in Microsoft Teams and was told an administrator has to approve it first. Your organization lets only administrators approve new apps, so they cannot get past this on their own — however many times they try. This page explains what approving grants, product by product, so you can decide.
Who can approve, and how
- Open the link in the request you were sent. It goes to Microsoft’s sign-in page (
login.microsoftonline.com), not to us, and names the app it is for. - Sign in as a Global Administrator (or a Privileged Role Administrator). AB Projects, AB Sales and AB Support include application permissions to Microsoft Graph (Microsoft 365’s interface for mail, calendars and Teams), which a Cloud Application Administrator cannot grant.
- Review the permissions and choose Accept. You are returned to a page that says whether the approval went through.
Approval covers everyone in your organization; nobody else has to ask. Let the person who asked know they can open the app again.
Two kinds of permission
Delegated
The app acts as the signed-in person and can never do more than they can do themselves.
Application
The app acts as itself, with nobody signed in — for example, sending mail from a shared mailbox on a schedule. These are the ones to read carefully.
AB Projects
Client id 25e9a931-8249-4c4a-aee8-1fd0627d9008 (shown in Entra as “AB Platform”).
| Permission | Type | What it is used for |
|---|---|---|
openid, profile, email, User.Read, offline_access | Delegated | Signing the person in: their name and email address |
Team.ReadBasic.All, Channel.ReadBasic.All | Delegated | Listing the person’s teams and channels, so a project can belong to one |
ChannelMessage.Send, ChannelMessage.ReadWrite, ChannelMessage.Read.All | Delegated | Posting task updates in the channel a project belongs to, and keeping replies in step |
Calendars.ReadWrite | Delegated | Putting task deadlines on the person’s own calendar, and finding free time for a meeting |
Schedule.Read.All, Group.Read.All | Delegated | Being removed Not used by the app |
ChannelMember.Read.All, TeamMember.Read.All | Application | Reading who is in a team or channel the app is installed in, so tasks can be assigned to them |
AB Sales
Client id 58af4c03-4c0a-4916-98c0-f1d27852bf67.
| Permission | Type | What it is used for |
|---|---|---|
User.Read | Delegated | Signing the person in |
OnlineMeetingTranscript.Read.All | Delegated | Reading the transcript of a meeting the person was in, only when they ask to capture it |
Mail.Send, Mail.ReadWrite | Application | Sending sales email from your own mailbox and filing replies with the lead. See Sending email. |
AB Support
Client id b9b2fe75-454d-4479-8afc-897c75d7a31d.
| Permission | Type | What it is used for |
|---|---|---|
openid, profile, email, User.Read | Delegated | Signing the person in |
Mail.Send, Mail.ReadWrite | Application | Receiving customer email into the support desk and sending replies from your support mailbox |
sales@yourcompany.com.AB Talent
Client id 30ddc2db-044f-4141-842b-5b7d09d98c28.
| Permission | Type | What it is used for |
|---|---|---|
User.Read | Delegated | Signing the person in |
AB Talent asks separately, with its own explanation, if your HR team later wants the roster filled from your directory or candidate email sent from your mailbox.
What none of them do
None of them read anyone’s personal email, files or chats. Application mail permissions exist only for AB Sales and AB Support, for the mailboxes they send from, and an Exchange application access policy limits them to exactly those.
If you would rather not approve
Then the app cannot be used in your organization — there is no reduced mode that works without sign-in. Please tell the person who asked, so they are not left trying again.