Allow users to connect Microsoft 365 mailboxes without repeated admin approval

This guide is for Microsoft Entra admins whose organisation doesn’t let users approve third-party apps themselves.

Why you’d do this

When someone connects their own mailbox, Microsoft asks for permission for timetoreply to read it. If users can’t give that permission, every mailbox creates a separate admin approval request.

A custom app consent policy lets the users you choose approve timetoreply themselves, during the normal connection process.

Users in the policy can	Users in the policy can’t
Connect their own mailbox to timetoreply	Get admin rights
Approve timetoreply’s permissions for themselves	Approve any other third-party app
	Give timetoreply access to every mailbox in your tenant

Each mailbox owner still connects their own mailbox. This is more restrictive than giving tenant-wide admin consent.

Note

If your organisation needs an admin to approve every permission, keep using Microsoft’s standard admin approval process and approve timetoreply’s requests one by one.

Choose your permissions

timetoreply’s Microsoft application (client) ID is:

ca7f3ddb-4052-4e29-a3e1-9bef37e1bf4f

The permissions depend on whether email body ingestion is turned on in timetoreply:

Email body ingestion	Permissions	What timetoreply can read
Off (standard)	offline_access, User.Read, Mail.ReadBasic	Email metadata only. Not email bodies, previews, attachments or extended properties.
On	offline_access, User.Read, Mail.Read	Email bodies too, so body-based features work.

If you use timetoreply’s calendar sync, also add Calendars.Read to either set.

timetoreply also asks for Mail.Read when the first connection can’t subscribe to new mail, even if email body ingestion is off. Add Mail.Read to the off sets below if that retry should not need an admin.

Before you start

You need:

• A Microsoft Entra ID P1 or P2 licence. Microsoft needs one to create custom roles.
• Microsoft Graph PowerShell installed.
• A Microsoft Entra admin account that can manage app consent policies and directory roles.
• Permission to assign users or groups to custom Microsoft Entra roles.

Set it up

1. Connect to Microsoft Graph

Open PowerShell and run:

Connect-MgGraph -Scopes "Policy.ReadWrite.PermissionGrant", "RoleManagement.ReadWrite.Directory", "Application.Read.All"

2. Set the application IDs

# Microsoft Graph resource application ID
$msGraphAppId = "00000003-0000-0000-c000-000000000000"
# timetoreply Microsoft application/client ID
$timetoreplyClientAppId = "ca7f3ddb-4052-4e29-a3e1-9bef37e1bf4f"

3. Choose the permissions

Run only one of these, to match your permissions.

Email body ingestion off:

$scopeNames = @("offline_access", "User.Read", "Mail.ReadBasic")
# Or, if the new-mail subscription retry should not need an admin:
# $scopeNames = @("offline_access", "User.Read", "Mail.ReadBasic", "Mail.Read")

Email body ingestion on:

$scopeNames = @("offline_access", "User.Read", "Mail.Read")

Email body ingestion off, with calendar sync:

$scopeNames = @("offline_access", "User.Read", "Mail.ReadBasic", "Calendars.Read")
# Or, if the new-mail subscription retry should not need an admin:
# $scopeNames = @("offline_access", "User.Read", "Mail.ReadBasic", "Mail.Read", "Calendars.Read")

Email body ingestion on, with calendar sync:

$scopeNames = @("offline_access", "User.Read", "Mail.Read", "Calendars.Read")

4. Look up the permission IDs

$msGraph = Get-MgServicePrincipal -Filter "appId eq '$msGraphAppId'"
$scopeIds = $msGraph.Oauth2PermissionScopes |
  Where-Object { $scopeNames -contains $_.Value } |
  Select-Object -ExpandProperty Id

To check you have the right ones:

$msGraph.Oauth2PermissionScopes |
  Where-Object { $scopeNames -contains $_.Value } |
  Select-Object Value, Id

5. Create the consent policy

$policyId = "timetoreply-user-consent-policy"
$policyName = "timetoreply user consent policy"
$policyDescription = "Allows assigned users to grant consent for the timetoreply application for approved Microsoft Graph delegated permissions."

New-MgPolicyPermissionGrantPolicy `
  -Id $policyId `
  -DisplayName $policyName `
  -Description $policyDescription

6. Limit the policy to timetoreply

This rule allows only timetoreply, and only the permissions you chose:

New-MgPolicyPermissionGrantPolicyInclude `
  -PermissionGrantPolicyId $policyId `
  -PermissionType "delegated" `
  -PermissionClassification "all" `
  -ClientApplicationIds @($timetoreplyClientAppId) `
  -Permissions $scopeIds `
  -ResourceApplication $msGraph.AppId

7. Create a custom role

This role lets users give consent for themselves only, through the policy:

$roleDisplayName = "timetoreply mailbox users"
$roleDescription = "Allows assigned users to grant consent to timetoreply on behalf of themselves only."
$templateId = (New-Guid).Guid
$rolePermissions = @{
  allowedResourceActions = @(
    "microsoft.directory/servicePrincipals/managePermissionGrantsForSelf.$policyId"
  )
}

New-MgRoleManagementDirectoryRoleDefinition `
  -DisplayName $roleDisplayName `
  -Description $roleDescription `
  -TemplateId $templateId `
  -IsEnabled:$true `
  -RolePermissions $rolePermissions

8. Assign users or groups to the role

1. In the Microsoft Entra admin center, go to Roles & admins.
2. Search for and open the timetoreply mailbox users role.
3. Click Add assignments.
4. Add the users or groups who should be able to connect their own mailbox.

Tip

Assigning a group is easier to manage than assigning users one by one. Only role-assignable groups can be given a role. You choose this when you create the group, and you can’t change an existing group to be role-assignable.

9. Ask users to connect their mailbox

Once the role assignments have taken effect, users can connect their mailbox. They may still see Microsoft’s permission screen, but they can approve it themselves without creating an admin approval request.

Check the setup

List your app consent policies:

Get-MgPolicyPermissionGrantPolicy | Format-Table Id, DisplayName, Description

See the rules in the timetoreply policy:

Get-MgPolicyPermissionGrantPolicyInclude `
  -PermissionGrantPolicyId "timetoreply-user-consent-policy" | Format-List

Remove the setup

1. Remove all users and groups from the timetoreply mailbox users role.

2. Delete the consent policy:

   Remove-MgPolicyPermissionGrantPolicy `
     -PermissionGrantPolicyId "timetoreply-user-consent-policy"

3. Delete the custom role from Roles & admins in the Microsoft Entra admin center.

Need help or have feedback?

Email us at support@timetoreply.com. We’re happy to help.