Enable Microsoft Account Connections for Discovered

Overview

Some organizations restrict Microsoft account connections to third-party apps. This can block key Discovered features, including Microsoft single sign-on (SSO), calendar sync, and email integration.

The Discovered application (DiscoveredATS) is a multi-tenant app. Before any of your users can connect their individual Microsoft accounts, an administrator must approve the application for your organization one time. This one-time admin approval is a required first step, not an optional one. A regular user connection cannot complete until it is in place.

This article explains how to grant that approval while maintaining enterprise security standards.

How the connection works (please read first)

A few points prevent the most common setup problems:

• DiscoveredATS is owned and maintained by Discovered. You do not register, build, or configure an application in your own directory.
• You do not need to add Microsoft Graph permissions manually. The required permissions are defined in the Discovered application and are presented to you on the approval screen.
• DiscoveredATS does not appear in the Microsoft Entra application gallery, and you do not need to look for it there. An empty gallery search is expected.
• Admin approval must happen before users connect. If a user attempts to connect first, they may see a sign-in error (see Troubleshooting). This is expected and is resolved by the admin approval described below.

Prerequisites

Before you begin, make sure you have:

• Global Administrator or Privileged Role Administrator rights in your Microsoft 365 tenant (required to grant tenant-wide admin consent).
• Access to the Microsoft Entra admin center or the Azure portal.
• A supported environment (Microsoft 365 / Microsoft Entra ID).
• Approval to grant the delegated Microsoft Graph permissions listed below.

Step 1 (required): Grant admin approval for your organization

Choose either method. Both produce the same result: the Discovered application is added to your directory and approved for your whole organization.

Method A: Approve by URL (recommended)

Open the following URL in a browser:

https://login.microsoftonline.com/common/adminconsent?client_id=ec2ac0ab-886e-4e9f-a9cd-f71b20dcc174

Sign in with a Global Administrator account.

Review the requested permissions and select Accept to approve on behalf of your organization.

This adds DiscoveredATS to your directory and grants approval tenant-wide.

Method B: Approve an app already awaiting approval

If one of your users has already attempted to connect, the Discovered application may already be present in your directory in a pending state. To approve it there:

1. In the Microsoft Entra admin center or Azure portal, go to Enterprise applications.
2. Select DiscoveredATS.
3. Open Permissions (or Security > Permissions) and select Grant admin consent for [your organization].
4. Review the requested permissions and confirm.

This achieves the same result as Method A.

Step 2: Users connect their accounts

After admin approval is complete, each user connects their own Microsoft account inside Discovered:

1. In Discovered, open account settings and select Connect Microsoft / Office 365.
2. Sign in with their Microsoft account and complete the prompt.

Users should now be able to connect without the earlier sign-in error, and email and calendar features become available for their account.

Optional: Allow users to consent for themselves

If your organization would rather let individual users approve the app themselves instead of relying on tenant-wide admin approval, an administrator can enable user consent:

1. In the Microsoft Entra admin center, go to Enterprise applications.
2. Select Manage, then Consent and permissions.
3. Set "Users can consent to apps accessing company data on their behalf" to an option that permits it (for example, allowing user consent for verified or low-risk apps).

This is an alternative to admin approval, not an addition. If an administrator has already approved the app in Step 1, no user consent is needed.

Permissions requested

Discovered requests only delegated (user-scoped) Microsoft Graph permissions. It does not request application-wide or broad administrative rights.

Security notes

• Discovered requests only delegated, user-scoped permissions. Access is limited strictly to the scopes listed above.
• Passwords are never stored. Authentication is handled entirely through Microsoft OAuth.
• Data is encrypted in transit and at rest, and is stored on U.S.-based servers.
• After approval, DiscoveredATS appears under Enterprise applications in your directory, where you can review or revoke its access at any time.
• Discovered's practices align with SOC 2 principles and privacy frameworks including GDPR and CCPA.

Troubleshooting

Do not create a separate custom app registration in your own directory. A new registration produces a different client ID that Discovered's service does not recognize, and the connection will fail.

What happens next

Once approval is complete and users have connected:

• Users can sign in with Microsoft (SSO).
• Outlook and Teams calendars sync with Discovered for scheduling.
• Users can send and receive candidate emails through their Microsoft accounts directly in Discovered.

If you need help, contact Discovered support and reference this article.