Client won't connect: "Microsoft declined this connection" and other import errors

This is for the MSP admin whose client didn't reach Connected after an import or a link. Each section is headed by the message Lemhi shows. When you finish, the client shows Connected and Lemhi can scan it.

Where it shows

Lemhi grants its consent in the client's tenant when you use Clients > Add Client > Import from Microsoft 365, or Link M365 tenant on an existing client. If Microsoft declines, the client stays in Pending consent.

To see the message, open the client's settings. The M365 Connection card shows Pending consent and "Waiting for admin consent in the client tenant." Select Link M365 tenant, pick the tenant, and select Connect. The message appears above the buttons.

When the message names something you fix outside Lemhi, the Connect button is hidden. Fix the cause, then open Link M365 tenant again.

Most of these causes live in your own Partner Center or Microsoft Entra, not in the client's tenant. Reconnecting Partner Connect fixes only the one that says your credentials are stale.

Microsoft declined this connection: the Partner Connect account (<account>) must be a member of a security group that holds Application Administrator or Cloud Application Administrator on this client's GDAP relationship.

The account that completed Partner Connect isn't in a group that holds a consent role on this client's relationship.

1. In Partner Center, open Customers > the client > Admin relationships > the relationship.

2. Under Security groups, find the group assigned Application Administrator or Cloud Application Administrator.

3. In Microsoft Entra in your own tenant, add the account to that group.

4. Close the sheet, open Link M365 tenant again, pick the tenant, and select Connect.

If no group on the relationship holds that role, check the relationship's roles. If Cloud Application Administrator is among them, assign it to your group (Step 3). If it isn't, which is always the case for a billing-only relationship, request a new relationship with the six roles in Step 1.

Microsoft declined the Partner Center request.

The full message: "In Partner Center, check that an active GDAP relationship exists with this client and that the user who connected Lemhi is in the AdminAgents group." Partner Center refused the call outright and gave no reason, so Lemhi gives you both checks.

1. In Partner Center, open Customers > the client > Admin relationships and confirm a relationship is Active. If there isn't one, start at Step 1.

2. Confirm the account that completed Partner Connect is an Admin agent. The steps are in Before you connect a client.

3. Close the sheet, open Link M365 tenant again, pick the tenant, and select Connect.

Microsoft declined this connection: this client's GDAP relationship has no security group access assignment covering the user who connected Lemhi.

The relationship exists, but no security group on it includes the account that completed Partner Connect. The full message ends: "In Partner Center, assign the relationship's roles to a security group that includes that user, then try again."

When Lemhi can read the relationship's groups, it shows one of these more specific messages instead.

Microsoft declined this connection: the Partner Connect account (<account>) is not in any security group assigned on this client's GDAP relationship.

It continues: "In Entra, add <account> to <group>, which holds <role> on that relationship, wait about 15 minutes, then connect again."

1. In Microsoft Entra in your own tenant, add the account to the group the message names. When two groups share the top role, the message reads "<group> or <group>, which both hold <role>".

   • If the message says the group holds Global Administrator, don't add the account to it. Assign Cloud Application Administrator on the relationship to a separate security group that holds only Lemhi's roles, then add the account to that group. If the relationship doesn't include Cloud Application Administrator, request a new relationship in Step 1.

2. Wait about 15 minutes.

3. Close the sheet, open Link M365 tenant again, pick the tenant, and select Connect.

Microsoft declined this connection: this client's GDAP relationship has no security group assigned Application Administrator, Cloud Application Administrator, or Global Administrator.

No group on the relationship holds a consent role.

1. In Partner Center, open the relationship. If it includes Cloud Application Administrator, assign that role to a security group the account is a direct member of (Step 3). If it doesn't, the relationship can't gain it: request a new one in Step 1. Don't assign Global Administrator.

2. Close the sheet, open Link M365 tenant again, pick the tenant, and select Connect.

Microsoft declined this connection: the GDAP relationship with this client has no active role assignments.

The client approved the relationship, but no security group was assigned to it. An approved relationship grants nobody access until you assign one. The full message ends: "Have a GDAP admin add a role assignment to the relationship in Partner Center, then connect again."

1. Complete Step 3 in Partner Center.

2. Close the sheet, open Link M365 tenant again, pick the tenant, and select Connect.

Microsoft declined this connection: this MSP's Partner Connect credentials are stale.

Lemhi's stored Partner Connect sign-in can no longer make this call. This is the one message here that reconnecting fixes.

1. Have an MSP admin go to Settings > Microsoft Partner Account and reconnect Partner Connect.

2. Close the sheet, open Link M365 tenant again, pick the tenant, and select Connect.

Microsoft blocked this connection because it has flagged the Partner Connect account (<account>) as a risky user in your organization's Microsoft Entra tenant.

Microsoft flagged the account that completed Partner Connect as risky in your own tenant. Only an Entra admin in your own organization can clear it.

1. In your own Microsoft Entra admin center, open Risky users (aka.ms/RiskyUsers) and review the account.

2. If you reset the account's password, reconnect Partner Connect first.

3. Close the sheet, open Link M365 tenant again, pick the tenant, and select Connect.

Microsoft declined this connection for a reason we don't recognize. Contact Lemhi support.

Microsoft said a retry won't help, and Lemhi doesn't recognize the cause. Send Lemhi the details listed at the end of this article.

Failed to grant Microsoft consent. Please try again.

Something temporary failed on Microsoft's side or the network. Wait a few minutes and select Connect again.

The client's tenant isn't in the Import list

The relationship isn't approved yet, or was approved moments ago.

1. Confirm the client's admin selected Approve all. See Step 2.

2. Wait a few minutes, then close and reopen Import from Microsoft 365.

If the list itself shows an error, see Partner Connect stopped working.

Pending consent

The consent call failed for one of the reasons above. The client stays in Pending consent until a connect succeeds.

1. Open the client and select Link M365 tenant (on the overview, Link tenant) to see the message.

2. Fix the cause from the matching section.

3. Select Link M365 tenant again and select Connect to retry.

Related

• Step 3: Assign your security group

• Step 4: Import the client

• Partner Connect stopped working

Still stuck? Send your Lemhi contact the client name, the exact message from the Connect step, and the account that completed Partner Connect.