# Microsoft 365 for IT admins (https://origolearn.com/en-fi/help/microsoft-365)

Approve Origo for your organization in Microsoft Entra ID.

Origo is a multitenant app in Microsoft Entra ID. If your organization doesn't let users consent to apps themselves, teachers are asked for admin approval the first time they connect a Microsoft account. You can approve Origo for the whole organization in advance.

## Check the app [#check-the-app]

- **App name:** Origo
- **Application (client) ID:** `60930bff-93cf-4cf9-b46c-df6e8887bf5e`

## Approve Origo [#approve-origo]

You need the Global Administrator, Cloud Application Administrator or Application Administrator role.

### With the approval link [#with-the-approval-link]

1. Open this link and sign in with your admin account:

   ```text
   https://login.microsoftonline.com/organizations/adminconsent?client_id=60930bff-93cf-4cf9-b46c-df6e8887bf5e&redirect_uri=https%3A%2F%2Forigolearn.com%2Fen-fi%2Fmicrosoft-complete
   ```

2. Review the permissions and choose **Accept**.

Origo confirms when the approval is done.

### In the Microsoft Entra admin center [#in-the-microsoft-entra-admin-center]

1. In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Enterprise applications** and open Origo.
2. Open **Permissions** and choose **Grant admin consent for** your organization.
3. Review the permissions and choose **Accept**.

Origo is listed after someone in your organization has tried to connect a Microsoft account.

### Approve a teacher's request [#approve-a-teachers-request]

If your organization uses the admin consent workflow, a teacher can request approval. Go to **Enterprise applications** → **Admin consent requests**, open Origo and approve the request.

## Permissions [#permissions]

Origo uses delegated, read-only permissions and only accesses data the signed-in user can open.

| Permission | API | Purpose |
| --- | --- | --- |
| `openid`, `profile`, `email` | Microsoft Graph | Sign in and identify the account |
| `offline_access` | Microsoft Graph | Keep the connection without signing in again |
| `User.Read` | Microsoft Graph | Read the account's basic profile |
| `Files.Read.All` | Microsoft Graph | Read files the user can open |
| `MyFiles.Read` | SharePoint | Read the user's OneDrive files |
| `AllSites.Read` | SharePoint | Read SharePoint sites the user can open |

## If teachers are still blocked [#if-teachers-are-still-blocked]

Check that you approved Origo with one of the roles above, in the same organization as the teacher's account. Admin consent doesn't apply to personal Microsoft accounts.

## Remove access [#remove-access]

To remove Origo's access for everyone, delete Origo under **Enterprise applications** in the Microsoft Entra admin center.