You have a Microsoft 365 subscription that uses Microsoft Teams. Users report that when they attempt to add a third-party app named App1 to the Microsoft Teams client they receive the following…

Creating a new app permission policy controls which apps are allowed or blocked for users, but it does not grant the necessary API permissions an app might require from the organization.

Modifying 'Org-wide app settings' might include general settings like allowing third-party apps, but it doesn't specifically address granting the specific API permissions an app requests which triggers the admin consent prompt.

The error message 'App1 needs permission to access resources in your organization that only an admin can grant' indicates that the application requires specific API permissions within Azure AD that users cannot consent to themselves. To resolve this, an administrator must go to the Microsoft Teams admin center (or Azure AD admin center), locate App1, and explicitly grant the organization-wide permissions it requests. This allows the app to function for users without requiring individual admin consent for each installation.

An app setup policy controls which apps are pre-installed or pinned for users, but it does not address the underlying issue of an app requiring admin-granted permissions to function.