Unable to connect Microsoft 365 mailbox to Jira Service Management – Admin Approval Required

Hi @Area Sistemi 

Welcome to the community.

See this Atlassian KB, this will provide you with all details an necessary links to Microsoft documentation.

user-gets-an-error-jira-cloud-atlassian-needs-permission-to-access-resources-in-your-organisation-when-setting-an-office-365-account-as-an-incoming-mail-server 

But you in Azure, you will need to have a Global Administrator or a Privileged Administrator to perform the changes.

Not today, going by anything Atlassian documents. Every documented way of attaching a Microsoft mailbox on Cloud runs through an interactive sign-in, and the tell is what happens when the wrong person does it. Their KB on that admin approval error warns that authenticating with an Azure AD admin account adds the admin account as the mail handler instead of the mailbox you wanted. That only happens where a signed-in identity is the thing being connected. Being straight though, that's me reading behaviour, Atlassian doesn't publish a line saying app-only is unsupported.

Nothing public on planned. Two open requests match your ask almost word for word, JSDCLOUD-13197 for OAuth without a personalized account and JSDCLOUD-14422 for a shared mailbox with a token issued for a different user, 71 votes on that one. Both sit at Gathering Interest, which isn't a commitment.

It's a genuine Cloud gap and worth putting to support in those terms. Data Center has a client credentials path on the Graph mail channel and Cloud doesn't.

One to plan around regardless: rotating the password on whichever account you connect drops the channel, and someone has to reconnect it by hand.

Good news, in a way: that "admin approval required" screen isn't coming from Jira at all - it's Microsoft's, which means the fix lives on the Microsoft 365 / Entra side and not in JSM.

Here's what's actually happening. When you add the mailbox, JSM kicks off an OAuth consent with Microsoft so it can read that inbox. Your Entra tenant is set up so that regular users can't consent to third-party apps on their own, so instead of letting it through, Microsoft stops it with "needs admin approval." Your JSM config is fine - you've just run into the tenant's app-consent policy.

Three ways through it, depending on how your M365 admins prefer to run things:

The simplest is to have a Microsoft 365 / Entra global admin do the connect step, or grant admin consent to the Atlassian app. Admins aren't subject to that block, so the consent goes straight through and the channel finishes connecting.

If they'd rather not do the connect themselves, they can switch on the admin consent workflow in Entra (Enterprise applications > Consent and permissions > Admin consent settings > "Users can request admin consent to apps they are unable to consent to" = Yes). After that, when you hit the screen you can submit a request and an admin approves it, instead of being dead-ended.

The third option is to relax user consent so users can approve apps themselves, but that's the broadest change and most orgs deliberately keep it locked down, so the first two tend to be the sensible route.

Whichever they pick, it's an Entra setting owned by a Microsoft admin, so that's the person to pull in - nothing more to change on the Jira side.