When you need this
When a colleague clicks Connect SharePoint and OneDrive in Blast Audit and Microsoft shows Approval required (or nothing happens), your organization has disabled user consent for third-party applications. This is common in audit firms. A Microsoft Entra administrator can approve Blast Audit once for the whole organization; after that, every user connects without any consent screen.
What Blast Audit asks for
Blast Audit is a verified publisher (NextBP) on Microsoft Entra. The application requests delegated, read-only permissions only:
Files.Read.All and Sites.Read.All: browse, search and download the OneDrive and SharePoint files the signed-in user can already open.
offline_access, openid, profile: keep the connection alive and identify the account.
Blast Audit never creates, modifies, shares or deletes anything in Microsoft 365. Delegated permissions mean the app inherits the user's existing access and never extends it. Tokens are encrypted at rest and can be revoked from the app settings at any time. Privacy policy: blast-audit.com/privacy-policy.
How to approve (Entra administrator)
In the Blast Audit dashboard, open Settings → Copilot 365, then expand Does your IT block the connection? under the SharePoint and OneDrive card.
Click Open the approval page, or copy the link and send it to your Entra administrator with the ready-made message (Copy a message for your IT). The administrator does not need a Blast Audit account.
The administrator signs in with a Global Administrator or Privileged Role Administrator account, reviews the permissions and clicks Accept.
Microsoft brings the administrator back to a Blast Audit page titled You have returned from Microsoft. Blast Audit cannot verify the approval from that browser return: the confirmation comes when a workspace admin reconnects SharePoint and OneDrive from Settings → Copilot 365 and no consent screen appears.
Users can now connect SharePoint and OneDrive from their own settings, and import files from the Excel add-in (Import → Import from cloud).
Reviewing or revoking the approval
The approval appears in Microsoft Entra under Enterprise applications → Blast Audit → Permissions. An administrator can review the granted permissions or remove the application at any time; existing Blast Audit connections stop working immediately after removal.
Troubleshooting
"Need admin approval" still appears for users: the approval was given on a different tenant than the one the user signs in with, or it has not propagated yet (allow up to 15 minutes).
"Microsoft did not complete the request" on the return page: the administrator declined, or the link was reused; ask the Blast Audit workspace admin to send a new approval link.
"AADSTS650052" or "the application requires access to a service": the tenant blocks Microsoft Graph delegated permissions by policy; the administrator must allow them in Entra → Enterprise applications → Consent and permissions.
Personal Microsoft accounts (outlook.com, hotmail) are not affected by admin consent: they connect directly to their own OneDrive.
