n8n Microsoft Graph OAuth2 fails after admin consent: fixes

The error "Need admin approval" in n8n cloud after your admin grants consent in Microsoft Entra usually means the consent was granted for the wrong permission type (Application vs Delegated), or your tenant's user consent settings block the OAuth flow. The fix is to ensure you are requesting Delegated permissions (not Application-level) in n8n, and that your tenant allows user consent. If your admin granted consent for Application permissions but n8n uses Delegated permissions, the consent is irrelevant and the error persists. Below are the exact steps to diagnose and resolve each cause.

The Full Answer

When n8n's Microsoft nodes (Teams, OneDrive, Outlook, etc.) show "Need admin approval" even after an admin grants consent in Microsoft Entra, the problem is almost always a mismatch between the permission type n8n requests and the permission type the admin consented to, or a tenant-level setting that blocks user consent. The error appears because the OAuth2 authorization code grant flow n8n uses requires Delegated permissions, but the admin may have consented to Application permissions, or the tenant may have disabled user consent entirely.

Check User Consent Settings in Your Tenant

According to the accepted Stack Overflow answer by Marc LaFleur, the first thing to verify is whether your tenant blocks user consent. Even if admin consent was granted, the OAuth flow n8n initiates is a user-driven consent flow (the "connect my account" button in n8n triggers an authorization code grant). If the tenant is configured to "Do not allow user consent," the flow will fail regardless of admin consent.

To check this setting:

1. Go to the Microsoft Entra admin center (https://entra.microsoft.com).
2. Navigate to Enterprise applications > Consent and permissions > User consent settings.
3. Look at the User consent for applications option. If it is set to Do not allow user consent, you must change it to Allow user consent for apps from verified publishers, for selected permissions (or a more permissive option) to let n8n complete the OAuth flow.
4. Save the change.

This setting is documented under Enterprise apps > Security > Consent and permissions in the Microsoft Entra interface. If your admin changed this setting after granting consent, you may need to re-initiate the OAuth flow in n8n (disconnect and reconnect the credential).

Application vs Delegated Permissions: The Most Common Cause

n8n uses the Authorization Code grant when you click "Connect my account" in a Microsoft node. This grant type uses Delegated permissions, which operate on behalf of the signed-in user. Delegated permissions grant access only to resources the user can already access through the Microsoft UI (e.g., their own OneDrive files, their own Teams messages).

If your admin granted consent for Application permissions (which operate without a signed-in user, like a background service), that consent does not apply to the Delegated permissions flow n8n uses. The error "Need admin approval" will persist because the OAuth request from n8n is asking for Delegated permissions that have not been consented to.

To confirm which permission type was consented to:

1. In Microsoft Entra, go to Enterprise applications > All applications and select your n8n app registration.
2. Go to Security > Permissions.
3. Look at the API permissions tab. If the consented permissions are listed under Application permissions (with a note like "Granted for [your company]"), but n8n is requesting Delegated permissions, you have a mismatch.

To fix this, you need to either:

• Add Delegated permissions to the app registration (e.g., Files.ReadWrite.All, User.Read, offline_access) and have the admin grant consent for those Delegated permissions, or
• Create a new app registration that uses only Delegated permissions and configure n8n to use that registration.

Marc LaFleur specifically notes: "The delegated version of this scope shouldn't require Admin Consent when operating on behalf of the User as it only provides access to drives/files they could access through the OneDrive UI. If that isn't the case, you likely selected the Application version of the scope which does require Admin Consent."

Configure Scopes Correctly in n8n

Even if the app registration has the right permissions, n8n must request the correct scopes. The scopes are provided as a space-delimited list in the authentication URL. To configure them:

1. In n8n, go to Credentials > Microsoft (or the specific node, e.g., Microsoft Teams, Microsoft OneDrive).
2. Click Create New or edit an existing credential.
3. In the Scopes field, enter the Delegated permissions you need. For example:

   Files.ReadWrite.All User.Read offline_access
   

   This requests read/write access to the user's files, basic profile read, and a refresh token.
4. Save the credential and try connecting again.

This is documented under n8n's Manage Credentials page. If you omit scopes, n8n may request default scopes that might not match what was consented to.

Verify Admin Consent Was Granted Correctly

If the above steps don't resolve the issue, double-check that admin consent was actually granted for the correct app and permissions. In Microsoft Entra:

1. Go to Enterprise applications > All applications and select the n8n app.
2. Go to Security > Permissions.
3. Under API permissions, you should see a status of Granted for [your company] next to the Delegated permissions. If you see Not granted, admin consent was not successfully applied.
4. If the status shows Granted but the error persists, the consent may have been granted for a different app registration (e.g., the admin used a different tenant app ID). Verify that the Application (client) ID in n8n matches the app registration in Entra.