SYNCDATE DocsYour work account needs admin approval
What to send your IT admin when your organisation blocks third-party calendar apps, and why only they can unblock it.
Last updated
Your organisation blocks third-party apps by default, and you can't approve this yourself. Your IT admin has to allow it, and it takes them about two minutes.
Send them the message below for your kind of work account. It has everything they need: the approval link or client ID, the exact permissions, and a link to syncdate.app/support/workspace-admin, the page written for admins.
What to send your admin
Microsoft 365 work or school account
Copy the paragraphs below, down to the line starting "What SYNCDATE accesses", and send them to your IT admin:
Subject: Approving SYNCDATE for calendar access
I'd like to use SYNCDATE to sync my work calendar, and our Microsoft 365 organization needs an admin to approve it.
You can approve it for our organization with this link. Sign in as an admin who can grant tenant-wide consent:
Application (client) ID: 4e28e278-b86c-4ae2-90b8-90c57cce5200
Delegated permissions: Calendars.ReadWrite, User.Read, offline_access, openid, email, profile
Only if I choose read-only or shared-calendar access: Calendars.Read, Calendars.Read.Shared, Calendars.ReadWrite.Shared
What SYNCDATE accesses, and other ways to approve it: https://syncdate.app/support/workspace-admin
The link opens Microsoft's own approval screen. Your admin signs in, reviews the permissions it lists and accepts. Microsoft may then open a SYNCDATE page showing a sign-in error; they can close it, because the approval is already saved. Then connect your work account again.
Google Workspace account
Copy the paragraphs below, down to the line starting "What SYNCDATE accesses", and send them to your Google Workspace admin:
Subject: Allowing SYNCDATE in our Google Workspace
I'd like to use SYNCDATE to sync my work calendar, and our Workspace settings block it.
To allow it, in the Google Admin console go to Security > Access and data control > API controls > Manage App Access, then Configure new app. Search for the client ID below, select SYNCDATE, choose who it applies to, and set access to Trusted (or Specific Google data, allowing the calendar scopes below).
OAuth client ID: 761398899444-00dsu2rtvqrrjdeijskng1932tb9msjb.apps.googleusercontent.com
Scopes: openid, email, profile, https://www.googleapis.com/auth/calendar.readonly, https://www.googleapis.com/auth/calendar.events
What SYNCDATE accesses: https://syncdate.app/support/workspace-admin
Configuring app access needs the Service Settings administrator privilege in Google Workspace. After your admin saves it, connect your Google account again.
How this shows up
A consent screen you can't get past. "Need admin approval", "Approval required", or a code starting AADSTS. Microsoft is telling you your tenant doesn't allow users to approve apps.
A connection that dies within minutes. The sign-in works, calendars appear, and then the account asks you to reconnect. An admin policy revoking the grant is one possible cause. A missing scope or unavailable Outlook mailbox can also cause a connection problem; check the account error in SYNCDATE and whether Outlook itself opens.
If a work account keeps dropping and a personal account on the same setup is fine, ask your admin to check its consent policy and mailbox.
What to do
There's a shortcut in the dashboard. When we detect the block, a card appears with the message already written for you — the details your admin needs, in a form you can send as-is. Copy message puts it on your clipboard; Email a copy to myself sends it to your own inbox if you'd rather forward it from there. Either way you're forwarding it on yourself: we don't contact your admin, and we're never told whether they approved it.
Or send them the message above. Either works.
What your admin is being asked to approve
Worth knowing, because it's the first thing they'll ask.
SYNCDATE uses delegated permissions for the account you connect. On Microsoft sign-in it requests read and write access to that account's calendars. When you connect another Outlook account or change its access on the Accounts page, you can choose read-only access, shared-calendar access, or no calendar access. Shared read lets you use calendars others shared with you as sync sources. Shared write lets you use one as a target only if its owner also gave you edit rights. New syncs copy events as Busy. A two-way Mirror between calendars you own keeps the real titles. You can change either before you start.
Your admin approving a scope does not automatically share anyone's calendar with you. The owner or Exchange admin must give your account access, and you must accept or add the calendar in Outlook. The Entra app registration can show more scopes than you selected; SYNCDATE sends your choice to Microsoft, and Microsoft may also display configured permissions on its consent screen. An earlier Microsoft grant is not revoked just by selecting narrower access later, but SYNCDATE enforces your current selection.
These are permissions for the connected account, not application-wide access to every mailbox in your company. Microsoft supports shared read consent for personal Microsoft accounts; it does not list shared write consent for them. Your company's admin approval applies to work accounts in its tenant, not to a personal Microsoft identity using the same email address.
SYNCDATE is also listed on Microsoft Marketplace and Google Workspace Marketplace, if that's a faster way for your admin to check us out than reading this page.
Admins who want to review it further can email support@syncdate.app.
If your admin says no
Some organisations won't approve any third-party calendar access, and that's a legitimate call on their part. Your options then:
- Sync the other direction. If the block is on your work Microsoft account, you may still be able to connect a personal account and push into it, depending on what exactly is blocked. This doesn't always work, and it depends on how the policy is written.
- Use a personal Outlook.com account if the work one is the blocked one.
- Tell us. If you're paying and the block leaves you unable to use SYNCDATE, email support@syncdate.app before your next renewal. Don't sit on a subscription you can't use.
We can't work around an admin block, and we wouldn't want to. A tool that bypasses your company's app policy is a tool your company is right to distrust.
Known limitations
- There's no way for us to request approval on your behalf. The request has to come from inside your organisation.
- We can't tell you whether your admin has approved it. Nothing notifies us. You'll find out by trying to connect again.
- Approval is sometimes per-user rather than tenant-wide. If a colleague was approved and you weren't, your admin needs to approve you separately.
Related
What SYNCDATE can't do
The limits no plan removes: syncs don't chain, special event types are Google-only, feeds are read-only, and colour is approximate between providers.
Outlook ↔ Google, both directions
Book in Outlook or Google and the other one agrees, with real titles and locations. Works with Microsoft 365 and Outlook.com. Works on the Free plan.
Connecting a second or third account
How to add another Google, Microsoft or iCloud login, what happens when one is already connected, and what disconnecting does to your copies.
Connect a shared Outlook calendar
How Microsoft consent and calendar sharing work together, and when a shared calendar can be a sync source or target.