Let people request admin approval

Many organisations don’t let people approve apps for themselves. When someone tries an app that hasn’t been approved, Microsoft shows a Need admin approval page. Out of the box, that page is a dead end.

With admin consent requests turned on, the same page lets the person explain why they need the app and send a request. The administrators you choose get an email and can approve or deny it in the Microsoft Entra admin center.

This is a Microsoft setting for your whole organisation, not just for Lumi. It’s optional: if you’ve already approved Lumi, nobody will be asked for approval to sign in to it.

Before you start

You need to be a Global Administrator to change this setting.

Turn on admin consent requests

1. Go to the Microsoft Entra admin center.
2. Open Enterprise applications. Depending on your menu, it’s under Entra ID or under Identity → Applications.
3. Select Consent and permissions, then Admin consent settings.
4. Set Users can request admin consent to apps they are unable to consent to to Yes.
5. Under Who can review admin consent requests, add the reviewers. You can choose people, groups or roles.
6. Choose the notifications:
   • Selected users will receive email notifications for requests: Yes is recommended, so requests don’t go unnoticed.
   • Selected users will receive request expiration reminders: optional.
7. Set Consent request expires after (days). Anything from 1 to 30 days; a request nobody acts on is closed after this.
8. Select Save.

Choosing reviewers

A reviewer can only approve a request if they also hold a role that can grant consent, such as Global Administrator, Cloud Application Administrator or Application Administrator. Reviewers without one of those roles can still see requests, and deny or block them.

Pick at least two reviewers, so requests are still answered when one of them is away.

What happens when someone asks

1. The person sees Need admin approval, types a reason, and selects Request approval.
2. Each reviewer gets an email (if you turned notifications on).
3. A reviewer opens Enterprise applications → Admin consent requests (under Activity), checks the app and its permissions, and chooses:
   • Review permissions and consent: approves the app for the whole organisation.
   • Deny: turns down this request. People can ask again.
   • Block: turns down the request and blocks the app, so nobody can sign in to it or ask for it again until an administrator unblocks it.
4. The person who asked gets an email with the outcome.

For Lumi, approving a request is the same as using the approval link: check the app is Lumi and the permissions match what Lumi asks for.