Whitelisting Falcon Builder in Microsoft Entra

The error

You click Connect on a Microsoft credential (Outlook, Excel, SharePoint, or OneDrive), sign in to Microsoft, and instead of returning to Falcon Builder you see a Microsoft screen like:

Need admin approval

Falcon Builder needs permission to access resources in your organization
that only an admin can grant. Please ask an admin to grant permission to
this app before you can use it.

Or you land back on Dashboard → Credentials with Microsoft's error text in a red banner, usually containing AADSTS65001 (“the user or administrator has not consented”) or AADSTS90094 (“an administrator has set a policy that prevents you from granting this app the permissions it is requesting”).

It applies to every Microsoft connection — Outlook, Excel, SharePoint, and OneDrive, including their trigger nodes — because they all sign in through Microsoft Entra ID (formerly Azure AD).

What is actually happening

Falcon Builder is a multi-tenant OAuth2 application registered with Microsoft by us. You do not register it yourself and there is no client secret for you to manage. The first time somebody in your tenant connects, Entra has to create a service principal for the app in your directory (it then shows up under Enterprise applications) and record who consented to which permissions.

Microsoft's default user-consent policy is “Allow user consent for apps from verified publishers, for selected permissions” — where the selected permissions are low-impact ones like User.Read. Reading mail, writing workbooks, and browsing SharePoint sites are not low-impact, so a regular user cannot approve them alone. An admin consents once for the organization, and after that every user in the tenant can connect without seeing the prompt.

What Falcon Builder asks for

All four connections use delegated Microsoft Graph permissions: the app acts as the signed-in user and can never reach anything that user could not reach themselves. Permissions are requested per connector — connecting Outlook does not ask for SharePoint access.

Tokens are encrypted at rest, scoped to the credential that owns them, and refreshed automatically. Falcon Builder never asks for a Global Administrator role, and never needs application (app-only) permissions for these four connections.

Step 1 — Get the app details

• Name on the consent screen: Falcon Builder (published by NeoSky AI).
• Application (client) ID: read it straight off the blocked sign-in. On the “Need admin approval” screen it is listed in the details, and it is also the client_id= value in the browser's address bar on login.microsoftonline.com. Admins can also find it in Entra admin center → Identity → Monitoring & health → Sign-in logs by filtering to the failed sign-in.
• Reply (redirect) URLs the app returns to — useful if you audit or allowlist destinations: https://www.falconbuilder.dev/api/auth/microsoft/callback, /api/auth/microsoft-excel/callback, /api/auth/sharepoint/callback, and /api/auth/onedrive/callback.
• Requested permissions: the table above.

Need the client ID and permission list in writing for a security review — or are you on a dedicated/self-hosted deployment where the registration differs? Email support@neoskyai.com.

Step 2 — Grant admin consent

Any one of these works. You need a Global Administrator, Privileged Role Administrator, or Cloud Application Administrator role.

Option A — Consent while connecting (simplest)

1. An admin signs in to Falcon Builder and opens Dashboard → Credentials.
2. Create or open the Microsoft credential and click Connect, signing in with the admin account.
3. On Microsoft's consent screen, tick “Consent on behalf of your organization”, then Accept.

This grants exactly the scopes that connector requests, tenant-wide. Other users can then connect their own accounts normally — each still gets their own credential and their own token.

Option B — Approve the user's request in Entra

1. If the admin consent workflow is enabled, the blocked user can click Request approval and add a justification.
2. In the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications → Admin consent requests.
3. Open the Falcon Builder request, review the permissions, and approve it.

Option C — Pre-approve with an admin-consent URL

To approve before anyone attempts a connection, an admin can open this URL (substitute your tenant ID and the client ID from Step 1, and URL-encode the space-separated scopes). This example grants the Outlook scopes:

https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent
  ?client_id={falcon-builder-client-id}
  &scope=openid profile email offline_access Mail.ReadWrite Mail.Send
         Calendars.ReadWrite Contacts.ReadWrite
  &redirect_uri=https://www.falconbuilder.dev/api/auth/microsoft/callback
  &state=admin-consent

Swap the scope and redirect_uri values for the connector you are approving (Excel, SharePoint, or OneDrive — see the table and Step 1). The redirect lands on a Falcon Builder page that will simply report a missing authorization code; the consent is still recorded. Repeat per connector, or use Option A per connector.

Option D — Consent from Enterprise applications

1. Once the app exists in your tenant (it appears after any sign-in attempt), go to Identity → Applications → Enterprise applications and search for Falcon Builder.
2. Open it, go to Security → Permissions, and click Grant admin consent for [your tenant].
3. Review the requested permissions and confirm.

Because scopes are requested dynamically per connector, this grants what has been requested so far. If a user later connects a different Microsoft product, its scopes may need consent too.

Step 3 — Review user consent settings (optional)

In the Entra admin center, go to Identity → Applications → Enterprise applications → Consent and permissions → User consent settings. Your options:

• Do not allow user consent — strictest. Admin consent (Step 2) is required, which is fine: grant it once and users are unblocked.
• Allow user consent for apps from verified publishers, for selected permissions — Microsoft's default, and the setting that produces this error for Mail/Files/Sites scopes.
• Allow user consent for all apps — users can approve for themselves; least restrictive and generally not recommended.

The recommended combination is to keep user consent restricted and enable the admin consent request workflow (same page, under Admin consent settings) so requests reach reviewers instead of dead-ending.

Step 4 — Conditional Access and app control

• Conditional Access — if policies restrict which cloud apps can be used, include Falcon Builder as an allowed app for the users and devices that need it. A hard block shows up as AADSTS53003.
• Defender for Cloud Apps — if you use OAuth app governance, check that Falcon Builder is not banned or pending review in the app governance / OAuth apps page, and mark it approved.
• Sign-in frequency — policies that expire sessions also invalidate stored refresh tokens on that cadence, so users have to reconnect periodically. See Microsoft MFA & Conditional Access Errors.
• Assignment — if you set Assignment required? to Yes on the enterprise application, add the users or groups allowed to connect; everyone else gets AADSTS50105.

Step 5 — Reconnect and verify

1. The user returns to Dashboard → Credentials and clicks Connect again on the Microsoft credential. Reconnecting from a credential's edit page updates it in place — it does not create a duplicate.
2. Sign-in should now complete without the approval screen and return to Falcon Builder with the connected email shown on the credential.
3. Click Test Credential to confirm access, then run your workflow or use Test Node in the editor.

Consent is recorded per tenant, so this is a one-time step for the organization (per Microsoft product connected) — not per user.

Error codes you might see

Notes for security reviewers

• Nothing to register. Falcon Builder registers its own multi-tenant app with Microsoft; your tenant only holds the resulting enterprise application and its consent record.
• Delegated only. These connections act as the signed-in user, bounded by that user's own access and their Conditional Access policies. No standing app-only access to your tenant is created.
• Revocable at any time. Remove access in Enterprise applications → Falcon Builder (review Permissions, or delete the application). Individual users can also revoke from myapps.microsoft.com, and deleting the credential in Falcon Builder deletes its stored tokens.
• Prefer app-only for unattended jobs? SharePoint and OneDrive also support an App-Only (client credentials) credential using your own Azure app registration and application permissions — no user, no MFA, no consent to a third-party app. See SharePoint App-Only and OneDrive App-Only. Outlook and Excel are delegated-only today.

Related

• Microsoft MFA & Conditional Access Errors
• Microsoft Outlook credential · Microsoft Excel · SharePoint OAuth2 · OneDrive OAuth2