Authorize Kasar in your Microsoft 365 tenant

You are being asked to authorize a third-party application to access, on behalf of each user who turns it on, their mailbox and their calendar. Kasar requests delegated permissions only: the application can never reach a mailbox without a user having signed in, and never exceeds that user’s own rights. It takes a few minutes and can be revoked at any time, without us.

01The application you are authorizing

02Why the connection is refused

Kasar is a multi-tenant application registered in Microsoft Entra ID. Your tenant, meaning your Entra ID directory, is configured to stop users from granting consent themselves: either user consent is disabled, or it is restricted to verified publishers. Only an administrator can lift that block.

03The permissions requested

04What the consent screen will show

Microsoft frames the consent screen with a warning when the publisher is not verified through its partner program. So you may read, on the very screen where you authorize, that the application is not published by Microsoft or by your organization. That message does not describe the permissions requested: it describes the publisher’s status in a Microsoft program, and it appears for the large majority of independent publishers.

What can be checked, on the other hand, is the Application ID shown in the consent screen details: it must be exactly the one in the first section. That match is the only proof that you are authorizing our application and not another. If your internal policy requires a verified publisher, write to us and we will tell you where our verification stands.

05Granting consent

Three routes to the same result, depending on where you start. Begin with case 1: its first step tells you which one applies. In all three, use an administrator account of YOUR tenant. Granted from a service provider’s directory, the authorization would be recorded in the wrong place, with no error message at all.

Case 1. The application is already in your directory

The common case: your colleague’s attempt to connect created the entry, even though it failed.

Case 2. The application does not appear

This link creates it and grants the authorization in a single operation. Replace the domain with a verified domain of your directory, or with its tenant ID.

If Microsoft answers AADSTS90002, the domain you put in the URL is not one of your directory. Use the tenant ID (Overview, Tenant ID), or replace that segment with "organizations": your tenant is then derived from the account you sign in with.

Case 3. You prefer the command line

To keep a trace of the operation, or to open no consent screen at all. Same result as case 2.

The first command alone is enough to make Kasar appear under Enterprise applications, if you would rather grant consent from the interface afterwards, as in case 1.

06Approving case by case, without opening a link

If your policy forbids opening a link supplied by a vendor, Entra offers an internal route: the blocked user requests the authorization, and you approve it from your own portal. The permissions granted are exactly those in section 3.

07Restricting it to a few users

All three routes authorize the application for the whole tenant. For a pilot, grant consent normally, then set Properties, "Assignment required" to Yes, and declare the allowed people or groups under "Users and groups". Any other user is refused at sign-in, and opening it up later is a matter of adding a group.

If your internal policy requires that no consent be recorded on behalf of the organization, case 3 accepts -ConsentType "Principal" -PrincipalId [user identifier], to be run for each person.

08Revoking

Reversible at any time and without us: Enterprise applications, Kasar, Properties, Delete. You can also withdraw the consent alone from the Permissions tab, keeping the entry and its history.

Revocation applies immediately to any new request. Access tokens already issued stay valid until they expire, which Microsoft sets between sixty and ninety minutes: allow up to an hour and a half before all access actually stops.

Access stays visible in your Entra sign-in logs, which lets you audit real usage rather than take our word for it.