16 articles
Getting Started·3 min read

Granting Admin Consent

Admin consent connects the shared M365Suite application to your Microsoft 365 tenant. It is required before the shared app can discover sites or run backups.

Who should complete it

Use a Microsoft Entra administrator who can approve the requested application permissions in your tenant. If the signed-in user is not allowed to approve consent, Microsoft will block the consent step.

The user who completes the verified consent flow is promoted to an M365Suite admin for that tenant. Signing in alone does not make a user an admin.

Permissions used

M365Suite separates read operations from the restore operation.

  • Sites.Read.All for Microsoft Graph is used to discover SharePoint sites.
  • Group.Read.All for Microsoft Graph is used to resolve audience group names.
  • Sites.Manage.All for SharePoint Online is used for SharePoint navigation access and is required when restoring navigation. Restore is the write action in the product.
  • User.Read is delegated and is used for the person signing in to the portal.

The Settings page shows the current permission model under Settings & Access → Connection → Required Permissions. Treat that in-product list as the authoritative view for your tenant.

Complete consent

  1. Sign in at portal.m365suite.com.
  2. Open Settings & Access.
  3. Open Connection if that tab is available to your role.
  4. In Directory Connection, select Grant Admin Consent or Update Permissions (Re-consent).
  5. Complete the Microsoft Entra prompt.
  6. Return to the portal and confirm that the connection shows Connected.

After consent, an admin can start site discovery from Estate Explorer. Discovery and classification are separate background stages, so classification may continue after site discovery completes.

Re-consent

Use Update Permissions (Re-consent) when the application permissions need to be refreshed. Tenant admins control this action. If your organization uses its own app registration, use the BYOA connection flow instead.

Using your own app registration

Business, Enterprise, and Enterprise Plus plans can use Bring Your Own Application (BYOA). See Bring Your Own Application for the exact certificate and permission steps.