How to Authorise Thrive Hub for Outlook

Hub includes several Microsoft-powered widgets that allow users to connect their Microsoft accounts for a richer experience:

• Outlook Calendar widget: View upcoming calendar events

• Teams Calendar widget: View Teams meeting schedule

• Outlook Mail widget: View recent emails

• Teams Messages widget: View recent Teams messages

These widgets use OAuth sign-in via the Thrive Hub for Outlook app registration (provided by Thrive Learning and powered by Unified.to). When a user in your organisation first attempts to connect one of these widgets, Microsoft may display the following prompt:

"Thrive Hub for Outlook needs permission to access resources in your organisation that only an admin can grant. Please ask an admin to grant permission to this app before you can use it."

This is expected behaviour for enterprise Microsoft 365 tenants with admin consent policies enabled. This guide explains how your IT administrator can grant the necessary consent so that your users can connect seamlessly.

Prerequisites

Before following the steps below, ensure you have:

• A Microsoft 365 Global Administrator or Application Administrator account

• Access to the Microsoft Entra admin center

• The Thrive Hub for Outlook app details:

  • Application (client) ID: 5bacaeb0-d1f1-4719-95f1-21bd8e57db08

  • Publisher: Thrive Learning

Which permissions will I be approving?

The permissions requested depend on which widgets your users connect. Permissions are requested per connection, so a user who connects only their calendar is not asked for access to their mail.

• Sign-in, always: Read the user's basic profile, and keep the connection active without repeated sign-in.

• Outlook Mail widget: Read the user's mail, and list their mail folders.

• Outlook Calendar and Teams Calendar widgets: Read and write the user's calendar.

• Teams Messages widget: Read the user's Teams chats and channel messages, and read the basic profile (name and photo) of message authors.

Note:

For the exact Microsoft Graph permission names, see Microsoft Integration Permissions.

Granting Admin Consent

There are two ways to grant admin consent. Choose the method that best suits your organisation.

There are two ways to grant admin consent. They are not equivalent, so choose deliberately.

Method 1: Approve when a user connects (Recommended)

This method approves only the permissions needed for the widget being connected, which is the smallest possible set.

1. Ask a user to connect a Microsoft widget in Thrive Hub.

2. On the "Need admin approval" screen, click "Have an admin account? Sign in with that account".

3. Sign in with your Global Administrator or Application Administrator credentials.

4. Review the list of permissions being requested.

5. Check the box "Consent on behalf of your organisation".

6. Click Accept.

All users in the organisation can now connect that widget without needing individual approval.

Note:

If you approve permissions for some widgets only, users who later add a different widget will need a further approval. This is expected, and it is the trade-off for granting the smallest set of permissions.

Method 2: Grant Consent via the Microsoft Entra Admin Center

Important:

This method approves every permission the app declares, including permissions for widgets your organisation may not use. If you want to approve only what your users need, use Method 1 instead.

Step 1: Sign in to Microsoft Entra

1. Go to https://entra.microsoft.com

2. Sign in with your Global Administrator or Application Administrator account

Step 2: Find the Thrive Hub for Outlook application

1. In the left-hand menu, navigate to Entra ID → Enterprise App

2. Click the All applications tab

3. Search for Thrive Hub for Outlook

4. Click on the application to open it
   

Step 3: Grant admin consent

1. In the left-hand menu of the application, click API permissions

2. Review the listed permissions (see the Permissions Reference section below)

   

3. Click Grant admin consent for [Your Organisation Name]

4. Confirm the action when prompted

5. The permission status should update to show a green ✅ Granted for [Your Organisation] badge

Step 4: Verify

Ask a user to attempt to connect a Microsoft widget in Thrive Hub. They should now be able to sign in and connect without seeing the "Need admin approval" message.

Reducing permissions you have already approved

If your organisation has already granted consent and you want to reduce it, you have two options.

Option 1 – simplest. In Microsoft Entra, go to Enterprise applications, open Thrive Hub for Outlook, select Permissions, and choose Revoke admin consent. Then approve again using Method 1 or Method 3, granting only the permissions you need. Your users will need to reconnect their accounts.

Option 2 – no reconnection needed. An administrator can edit the granted permissions directly using Microsoft Graph PowerShell. Contact Thrive Support and we will provide the exact steps for your situation.

Why is Admin Approval Needed?

Most Hub widget permissions do not need administrator approval. Users can approve access to their own mail, calendar, and profile themselves.

A small number of permissions do need administrator approval, because Microsoft treats them as reading data across the whole tenant rather than only the signed-in user's own data. Microsoft always requires an administrator to approve these, regardless of the application.

Security and Data Handling

• Delegated access only: The app cannot access any data unless a user has explicitly signed in and consented. It has no application-level access to your tenant's data.

• No content storage: Thrive Hub displays email, calendar, and message content in real time. That content is not stored on Thrive's servers.

• Token storage: The access and refresh tokens for your connection are held securely in encrypted storage by Unified.to, Thrive's integration partner. Thrive stores only a reference to the connection, never your credentials.

• Encryption: All data is transmitted over HTTPS/TLS.

• Revocation: Users can disconnect their Microsoft account at any time from within Thrive Hub. Admins can revoke consent at any time from the Microsoft Entra admin Center.

Troubleshooting

• Users still see "Need admin approval" after consent was granted

  • Ensure consent was granted by an account with Global Administrator or Application Administrator role. Other roles may not have sufficient permission.

  • Check that consent shows Granted (not just "Added") in the API permissions panel.

  • Ask the user to sign out of Thrive Hub and try again. A fresh sign-in is sometimes needed to pick up the new consent.

  • If consent was granted for some widgets only, a user adding a different widget will need a further approval. This is expected.

  • Check whether your tenant has User consent settings configured to block all third-party apps. If so, admin consent alone may not be sufficient and your admin consent policy may need reviewing.

• A user connected successfully but the widget shows no data

  • Some Microsoft consent screens let a user clear individual permissions before approving. If a required permission was not approved, the widget cannot load data. Ask the user to disconnect and reconnect, approving all requested permissions.

• The app doesn't appear in App registrations

  • Try searching under Enterprise applications instead. This is where multi-tenant apps provisioned to your tenant typically appear.

  • Ensure you are searching for the exact name: Thrive Hub for Outlook

  • You can also search by Application ID: 5bacaeb0-d1f1-4719-95f1-21bd8e57db08

• How can I verify that authorisation succeeded?

  1. In Microsoft Entra, go to Enterprise applications → Thrive Hub for Outlook → Permissions

  2. You should see the permissions listed with a status of Granted

  3. Alternatively, go to Enterprise applications → Thrive Hub for Outlook → Users and groups to see which users have signed in

• How do I revoke access?

  1. In Microsoft Entra, go to Enterprise applications → Thrive Hub for Outlook

  2. Click Permissions and select Revoke admin consent

  3. Individual users can also disconnect their account from within the Thrive Hub widget settings

Need Further Help?

If you're still experiencing issues after following this guide, please contact Thrive Support (https://support.thrivelearning.com) with the following information:

• Your Microsoft 365 tenant domain (e.g. yourcompany.onmicrosoft.com)

• The widget(s) affected

• Any error messages shown

• Whether your tenant uses conditional access policies or custom admin consent workflows

Note:

Last checked against the Thrive Hub app registrations: 17 August 2026