SparkReceipt Help

Why does Microsoft connect the wrong mailbox or ask for admin approval?

What to do when Microsoft connects the mailbox you're already signed in to, or shows "Need admin approval", as you connect an Outlook or Microsoft 365 mailbox for automatic email scanning.

ST
Written by SparkReceipt TeamUpdated Oct 20, 2026

Two things go wrong most often when you connect an Outlook, Hotmail, Live or Microsoft 365 mailbox to SparkReceipt with Microsoft sign-in:

  • Microsoft connects the wrong mailbox. You wanted to add a second mailbox, but Microsoft skipped the sign-in page and connected the mailbox you were already signed in to. Open SparkReceipt in a private browser window and sign in as the mailbox you want.
  • Microsoft shows "Need admin approval" or "Approval required". Your organization only lets an administrator approve apps like SparkReceipt. Ask your Microsoft 365 admin to approve SparkReceipt, then connect again.

Both are settings on the Microsoft side. Nothing is broken in your SparkReceipt account, and trying the same connect again gives the same result until you change something below.

For the connection steps themselves, see Automatic email scanning.

Microsoft connects the mailbox I'm already signed in to

What happens

Say you're signed in to Outlook on the web as mailbox A. In SparkReceipt you go to Settings → Scan receipts from email, click Connect email and pick Microsoft to add mailbox B. Microsoft shows no account picker and no sign-in page. It goes straight to the permissions screen for mailbox A, because that's who is signed in to Microsoft in your browser.

SparkReceipt then shows Microsoft account connected successfully! and takes you to the History Extraction page for the mailbox Microsoft sent back, which is mailbox A again. When you look at the list in Settings → Scan receipts from email, you see mailbox A and no mailbox B.

Connecting a mailbox that's already in your list doesn't create a copy or show an error. SparkReceipt refreshes the sign-in of the existing row, so you keep seeing mailbox A once. Repeating the connect gives the same result each time, because Microsoft reuses your existing sign-in each time.

The same thing can happen when you click Re-authenticate on a mailbox while your browser is signed in to Microsoft as a different mailbox.

How to connect the right mailbox

Pick one of these:

  1. Use a private window. Open a private or incognito window in your browser, sign in to SparkReceipt there, and connect Microsoft again. That window has no Microsoft sign-in, so Microsoft asks who you are. Sign in as mailbox B.
  2. Sign out of Microsoft first. Sign out at office.com or outlook.office.com in the same browser, then go back to SparkReceipt and connect Microsoft again.
  3. Switch account on the Microsoft page. If Microsoft shows Use another account or Sign in with a different account, choose it and sign in as mailbox B.

Afterwards, check Settings → Scan receipts from email. Mailbox B should be in the list next to mailbox A. If your plan allows one connected mailbox, see how many mailboxes you can connect.

Aliases and shared mailboxes

Microsoft sign-in connects the mailbox of the person who signs in. SparkReceipt reads that person's own mailbox and nothing else. So an address with no login of its own can't be connected this way. That includes:

  • an alias of another mailbox, such as receipts@ delivered into your own inbox
  • a shared mailbox you open under your own Microsoft login

For an alias, the mail already lands in the mailbox it belongs to. Connect that mailbox and receipts sent to the alias are picked up from its Inbox. For a shared mailbox, set up a forwarding rule that sends its mail to a mailbox you've connected, or to your SparkReceipt forwarding address. See How to forward e-receipts from your email.

Microsoft says "Need admin approval"

What it means

Instead of the permissions screen, Microsoft shows Need admin approval (sometimes Approval required). Your organization has turned off user consent for apps in Microsoft 365, so only an administrator can approve SparkReceipt. This is common in companies with an IT department. The setting covers every app, so it isn't specific to SparkReceipt.

If you use that screen's link to go back to SparkReceipt, you'll see Error connecting Microsoft. Connecting again won't help until an admin has approved SparkReceipt.

What SparkReceipt asks for

SparkReceipt asks Microsoft for read-only access to the one mailbox that signs in:

  • Mail.Read and Mail.ReadBasic: read your email so receipts and invoices can be found.
  • User.Read: your basic profile, so SparkReceipt knows which email address it connected.
  • offline_access: keeps the connection working in the background, so scanning continues after you close the browser.

SparkReceipt never sends, changes or deletes email in your mailbox. See Privacy and security for how email data is handled.

If you're not an admin

  • If the Microsoft screen has a box for a reason and a Request approval button, write a short note ("SparkReceipt reads receipts from my mailbox for bookkeeping") and send the request. Then let your admin know it's waiting.
  • If there's no such button, send your admin a link to this article and ask them to do one of the steps below.

When your admin is done, connect Microsoft again in Settings → Scan receipts from email. You should now see the normal permissions screen.

If you're the admin

Any one of these lets your users connect SparkReceipt. They are listed from quickest to broadest.

1. Approve while you connect. Connect your own mailbox to SparkReceipt while signed in with an admin account. If your account is a Global Administrator or Privileged Role Administrator, the permissions screen has a box called Consent on behalf of your organization. Tick it and accept. Everyone in your organization can then connect their own mailbox. Microsoft describes this screen in Consent experience for applications.

2. Grant admin consent in the Microsoft Entra admin center. You need at least the Cloud Application Administrator role.

  1. Sign in to the Microsoft Entra admin center.
  2. Go to Entra ID → Enterprise apps → All applications.
  3. Search for SparkReceipt and open it.
  4. Select Permissions under Security.
  5. Review the permissions and select Grant admin consent.

SparkReceipt only shows up in that list after at least one person in your organization has tried to connect it. If you can't find it, have a user try to connect once, or use option 1. Source: Grant tenant-wide admin consent to an application.

3. Let users approve apps themselves. This changes the setting for every app in your organization, so weigh it against your security policy. In the Microsoft Entra admin center, as a Global Administrator, go to Identity → Applications → Enterprise apps → Consent and permissions → User consent settings, choose Allow user consent for apps and select Save. Source: Configure how users consent to applications.

4. Approve a pending request. If a user sent a request with Request approval, go to Entra ID → Enterprise apps, select Admin consent requests under Activity, open the My Pending tab and approve SparkReceipt. Source: Review and take action on admin consent requests.

Users only get the Request approval button when the admin consent workflow is on. A Global Administrator turns it on under Entra ID → Enterprise apps → Consent and permissions → Admin consent settings by setting Users can request admin consent to apps they are unable to consent to to Yes. Microsoft says it can take up to an hour to start working. Source: Configure the admin consent workflow.

Mailboxes from GoDaddy and other resellers

If you bought your Microsoft 365 mailboxes through a reseller such as GoDaddy, they are still Microsoft 365 mailboxes, and the same Microsoft Entra steps apply. Mailbox licenses and passwords are managed in the reseller's dashboard.