Authorizing 365 Log ins to CloudRadial UCP

Signing in to CloudRadial with a Microsoft 365 account requires the CloudRadial application to be consented in the client's Microsoft Entra ID tenant (formerly Azure Active Directory). Microsoft recommends, and many organizations enforce, restricting end users from consenting to third-party applications. When that restriction is in place, users attempting to sign in to CloudRadial with Microsoft see a Need admin approval prompt and cannot continue until an administrator consents on their behalf.

This consent lives in the client's own tenant. If you manage the client's Microsoft 365 tenant, you can complete either option below. If you do not, their tenant administrator will need to do it.

Option 1: Grant admin consent for the whole organization (recommended)

This is a one-time step. Once it is done, no user in that tenant will be prompted to consent again.

1. Sign in to the client's tenant with an account that holds the Global Administrator, Privileged Role Administrator, or Cloud Application Administrator role.
2. Go to the client's CloudRadial portal URL and choose Sign in with Microsoft.
3. On the Permissions requested prompt, check Consent on behalf of your organization and click Accept.

If CloudRadial already appears in the tenant, you can grant consent from the Microsoft Entra admin center instead: go to Identity > Applications > Enterprise applications, open the CloudRadial application, select Permissions, and click Grant admin consent for [tenant name].

Option 2: Let users request admin approval

If the client prefers to keep user consent blocked and review requests case by case, enable the admin consent workflow so users can request approval from the Need admin approval prompt.

1. In the Microsoft Entra admin center, go to Identity > Applications > Enterprise applications > User settings.
2. Under Admin consent requests, set Users can request admin consent to apps they are unable to consent to to Yes.
3. Select the users, groups, or roles who will review requests, and choose whether reviewers are notified by email.
4. Save.

Users who hit the prompt can then click Request approval. Reviewers approve or deny the request under Identity > Applications > Enterprise applications > Admin consent requests. Approving grants tenant-wide consent for CloudRadial.

Troubleshooting

• The prompt appears for every user even after consent was granted: confirm the consent was granted on the correct tenant. Clients with multiple tenants need consent in each one.
• The signed-in admin does not see the "Consent on behalf of your organization" checkbox: the account does not hold a role that can grant tenant-wide consent. Use an account with one of the roles listed in Option 1.
• The user signs in but is immediately signed out or looped back to the login page: this is a different issue. See Troubleshooting Login Loop When Accessing the CloudRadial Portal.

Microsoft's reference documentation: User and admin consent in Microsoft Entra ID.