Granting the Exchange Administrator role

This is stage 3 of the setup wizard. It gives the Footer365 app the Exchange Administrator role in your directory, which is what allows it to create the connectors and mail flow rules that add signatures to your outbound email. Without it, mail flow cannot be set up.

The role is only needed if you choose Outlook add-in and mail flow in stage 2. If you choose Outlook add-in only, the stage shows Not needed for add-in only and no role is granted. Using the Outlook add-in only

Why you grant it, not Footer365

Footer365 holds no standing permission to change directory roles. The approval you gave in stage 1 can read role assignments, but not change them. So the role has to be assigned on your authority, by a Global Administrator, either through the wizard or by hand.

The stage is marked "Available once step 1 is approved." until you have completed stage 1, and "Available once step 2 is answered." until someone has chosen how Footer365 adds signatures.

Grant it from the wizard

1. Sign in to the wizard as a Global Administrator.
2. On Grant the Exchange Administrator role, select Continue to Microsoft.
3. Microsoft may show an approval screen. If it does, select Accept. You may instead be taken straight through with no prompt, because stage 1 can already have covered this approval.
4. A page saying "Granting access, please wait" can stay for up to a minute while your new connection finishes setting up. Leave it open.
5. You are returned to the wizard, which now says "Exchange Administrator role granted." Mail flow set-up starts straight away.

Nothing happens until you select the button: the wizard never sends you to Microsoft for this on its own.

What the Microsoft screen asks for

Expand If Microsoft does ask, what will it show? in the wizard to see this list for yourself.

• Read and write directory RBAC settings (RoleManagement.ReadWrite.Directory). This is a delegated permission: it lets Footer365 act as you, once, to add its app to the Exchange Administrator role, and only within what your own account can already do. It gives the app no power of its own when you are not signed in. The approval stays on record until you remove it in Enterprise applications.
• offline_access and profile. These are sign-in items you already approved in stage 1. Microsoft lists them again because it lists everything a sign-in requests.
• A "Consent on behalf of your organisation" tick box. You do not need to tick it. Leaving it clear keeps the approval to your account alone.

Assign it yourself instead

If you prefer not to approve the delegated permission, assign the role by hand. The same steps are under Prefer to assign it yourself? in the wizard.

1. Open the Microsoft Entra admin centre and go to Roles and administrators.
2. Select Exchange Administrator, then Add assignments.
3. Search for Footer365, select it, and click Add.

Keep the wizard open: it continues automatically once the role is assigned, and moves on to setting up mail flow.

If it does not work

When the grant fails, the stage shows That did not complete with one of these messages. You can always try again, or assign the role by hand as above.

Good to know

• The role is what lets the Footer365 app create, change and remove its connectors and transport rules, and change the Outlook on the web mailbox policy if you choose to turn people's own signatures off.
• The role is given to the Footer365 app, not to any person. It does not change what anyone in your organisation can do.
• An organisation using the Outlook add-in only that decides to add mail flow later comes here too: a Super Admin selects Add mail flow on Getting started, which opens the wizard at this stage.
• If you remove mail flow later, the role stays assigned, because Footer365 cannot change directory roles. A Global Administrator can remove it in the Microsoft Entra admin centre, under Roles and administrators, then Exchange Administrator.

Related

• Connecting Microsoft 365
• Permissions Footer365 asks for, and why
• What Footer365 creates in Exchange