Does a Microsoft Copilot Studio native app require admin approval for every user?

Question

Does a Microsoft Copilot Studio native app require admin approval for every user?

Unceta-Barrenechea, Irene 0

Hi,

I am integrating a Microsoft Copilot Studio agent into an internal Python desktop application using the Microsoft 365 Agents SDK and the official Copilot Studio client sample.

The application uses:

User interactive authentication
Public Client / Native App registration
Delegated permissions:
- CopilotStudio.Copilots.Invoke
  - Microsoft Graph User.Read

When I authenticate, Microsoft Entra displays an "Approval required" screen requesting administrator approval for the application.

My questions are:

If an Entra administrator approves the application, is that approval normally valid for the entire organization, so that other users can use the application without requesting approval again?
Or does each user need to submit an approval request the first time they use the application?
Is there any recommended deployment approach for internal desktop applications using the Microsoft 365 Agents SDK and Copilot Studio to avoid repeated approval requests?

My goal is to distribute this internal application to multiple users within the same Microsoft Entra tenant.

Thanks!

0 comments

2 answers

Your answer

Answer 1

Unceta-Barrenechea, Irene 0

Hi @Teddie-D,

Thank you, this is really helpful and clarifies the consent model.

On my side I've already completed the app registration in Microsoft Entra ID as a Public Client / Native App, with the delegated permissions (CopilotStudio.Copilots.Invoke and User.Read) configured. I've also submitted the admin consent request through the "Approval required" screen, so it's now pending approval from our Entra administrator.

Just to make sure I understand the remaining steps correctly:

Once the administrator grants tenant-wide admin consent for this app, is there anything else I need to do on the app registration side, or should authentication then work for the other users in the tenant without further prompts?
Is there a way for me (or the admin) to check the current status of the pending consent request, or does it simply resolve once the admin approves it?
If we later decide to restrict access to a subset of users via the Enterprise Application "user assignment" setting, is that configured independently of the admin consent, or does enabling it require a new consent flow?

For now I'll wait for the admin to grant consent and test again. Thanks again for the guidance!

Best regards,

Teddie-D 19,760 Reputation points Microsoft External Staff Moderator

2026-07-24T00:59:11.0366667+00:00

Hi @Unceta-Barrenechea, Irene

For your follow-up questions:

1.After the administrator grants tenant-wide admin consent, there is typically nothing else required on the app registration itself, assuming the permissions (CopilotStudio.Copilots.Invoke and User.Read) are already configured correctly. Users in the same tenant should then be able to authenticate without seeing the "Approval required" prompt for those permissions. If users still encounter consent prompts afterward, it would be worth checking whether the application is requesting additional scopes at sign-in that were not included in the original consent grant.

2.Checking the status of the consent request depends on your organization's configuration. An administrator can typically review pending requests through the Microsoft Entra admin center if the admin consent workflow is enabled. From the end-user side, there is usually no detailed status page for a submitted request. In many cases, you'll simply find that authentication starts working once the request has been approved. If you're unsure whether approval has been granted, your Entra administrator can verify whether admin consent has been granted for the application's permissions in the Enterprise Application or App Registration.

3.User assignment and admin consent are separate controls. Admin consent determines whether the application is allowed to use the requested permissions within the tenant, while user assignment determines who is allowed to sign in to the application. If you later enable "User assignment required" on the Enterprise Application and assign specific users or groups, that change does not normally require a new consent flow. The existing admin consent remains in effect; you're simply restricting which users can access the application.

Answer 2

Hi @Unceta-Barrenechea, Irene

Based on the standard Microsoft Entra consent model, if your application uses delegated permissions such as CopilotStudio.Copilots.Invoke and User.Read, the recommended approach for an internal desktop application is to have a Microsoft Entra administrator grant tenant-wide admin consent before distributing the application to users. When admin consent is granted on behalf of the organization, the consent applies to all users in the tenant and users generally do not need to submit individual approval requests for the same permissions.

To answer your specific questions:

1.If an Entra administrator approves the application, is the approval valid for the entire organization?

Tenant-wide admin consent grants the requested delegated permissions on behalf of all users in the tenant. By default, other users can sign in and use the application without having to grant consent themselves, unless additional access restrictions are configured.

2.Will each user need to submit an approval request the first time they use the application?

Once tenant-wide admin consent has been granted, users should not receive individual approval requests for those same permissions. Additional approval prompts may occur only if the application later requests new permissions, forces a new consent flow, or the tenant has restrictive consent policies configured.

3.What is the recommended deployment approach for an internal Python desktop application that uses the Microsoft 365 Agents SDK and Copilot Studio?

A common approach is:

Register a single application in Microsoft Entra ID.
Configure the required delegated permissions.
Have an Entra administrator grant tenant-wide admin consent.
Distribute the desktop application to users within the same tenant.
Allow users to authenticate interactively without requiring individual approval requests.

If access should be limited to a subset of users, you can configure the Enterprise Application to require user assignment and assign only specific users or groups. In that case, admin consent is still granted once, but only assigned users can access the application. You can read more at Manage access to apps - Microsoft Entra ID | Microsoft Learn

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.