For Microsoft 365 Administrators and Tenant Owners

This section is for whoever owns or administers a Microsoft 365 organization whose users want to use QuickMail — a tenant owner can make these changes; a dedicated IT administrator is not required. Personal Outlook.com / Hotmail / Live.com users do not need any of this — it applies only to work or school (Microsoft 365 / Exchange Online) accounts.

The short version: QuickMail is a Microsoft-registered desktop application that signs each user in to their own mailbox with their own credentials. Many organizations require an administrator to approve a new application once, for the whole organization, before users can sign in. Until you do, your users will hit a “needs admin approval” wall and cannot proceed. Granting approval is a one-time action and takes a couple of minutes.

What QuickMail is, in Microsoft terms

• QuickMail is a public client / desktop application registered in Microsoft Entra ID (Azure AD). Your users authenticate against that single registration; there is nothing to deploy into your tenant.
• It requests delegated permissions only. That means QuickMail acts only as the signed-in user, entirely within that user’s own mailbox, and only while they are using the app. It holds no application permissions — it cannot run in the background, and it cannot read or send mail for any user who has not personally signed in.
• Sign-in uses the modern authentication flow (OAuth 2.0 / MSAL). Passwords are never seen or stored by QuickMail; access tokens are held in an encrypted cache on the user’s own PC, protected by Windows DPAPI and readable only by that user’s Windows account. (Where a user connects over IMAP/SMTP with a password instead, that password is stored in Windows Credential Manager.) Sign-in honours your Conditional Access and MFA policies.

App registration details

Permissions QuickMail requests

All are delegated (act as the signed-in user, in their own mailbox):

If users connect over IMAP/SMTP instead of the default Microsoft 365 option, two Exchange Online scopes (IMAP.AccessAsUser.All, SMTP.Send) are used as well.

How to approve QuickMail for your organization

Any of these roles can grant approval — Global Administrator is not required: Cloud Application Administrator or Application Administrator.

Option A — Entra admin center. Sign in at entra.microsoft.com → Entra ID → Enterprise applications → QuickMail → Security → Permissions → “Grant admin consent for <your organization>”, review the list, and approve. (If QuickMail is not yet listed under Enterprise applications, use Option B — the first admin consent creates it.)

Option B — single-step consent URL. Sign in as one of the admin roles above and open:

https://login.microsoftonline.com/organizations/adminconsent?client_id=bcdc84f1-d37c-4581-b14a-a01f7b3a1312

Open this in a private/InPrivate browser window. A cached Microsoft sign-in session will skip the consent screen and send you straight to an error page (see Troubleshooting).

Replace organizations with your tenant ID or a verified domain to target a specific tenant. Review the permission list Microsoft shows and approve. This grants consent tenant-wide in one step.

Option C — from inside QuickMail. If you have QuickMail installed, choose Help → Grant Admin Consent for Your Organization…. Sign in as one of the admin roles above in the window that opens, review the permission list, and approve. This grants QuickMail’s Microsoft Graph permissions tenant-wide in one step without building a URL by hand, and it works even before anyone in your organization has added an account — the consent itself registers QuickMail in your tenant. QuickMail tells you when consent has been granted.

After approval, your users sign in normally with no further prompts.

If you would rather not grant blanket approval

• Let users request it. Enable the admin consent workflow (Entra ID → Enterprise applications → Consent and permissions → Admin consent settings). The dead-end prompt becomes a “Request approval” flow routed to reviewers you designate, so you approve per request instead of up front.
• You stay in control. Because QuickMail uses delegated permissions and standard modern auth, your existing Conditional Access, MFA, device-compliance, and app-consent policies all apply. You can restrict or block QuickMail like any other enterprise application at any time.

Troubleshooting

• Users see “needs admin approval” with no continue button. Your tenant requires admin consent and QuickMail has not been approved yet. Follow the steps above. This is expected until approval is granted.
• The consent link opens, asks you to sign in, then goes straight to an error page with no permissions to approve. Your browser is reusing a cached Microsoft sign-in session, which skips the consent screen. Open the link in a private/InPrivate browser window and sign in fresh — the permission list will appear. This also applies to the “Grant admin consent” button in the Entra portal.
• After approving, the browser shows “can’t reach this page” at http://localhost. That is expected and means it worked. QuickMail is a desktop app, so Microsoft redirects to a local address with nothing listening. Your approval is recorded before that redirect. Confirm it under Enterprise applications → QuickMail → Security → Permissions, which will now list the granted permissions.
• A user signed in successfully but delete or move fails with an error. Their token predates a permission grant. Have them remove and re-add the account (or sign in again) to pick up a fresh token.
• You approved QuickMail but a newly added feature still prompts. Admin consent covers the permissions declared at the moment it was granted. Re-grant consent (Option A or B) to pick up any newly requested permission.