[Enterprise Grid] New user OAuth fails with 'unapproved permission' — Slack admin UI approval not reflected in admin.apps.approved.list (workaround via API)

[mitou-dk]

Summary

In an Enterprise Grid workspace, new users attempting to connect Slack to claude.ai (via the official Claude Slack app, App ID A08SF47R6P4) consistently get the error "承認されていない権限がリクエストされました" ("Unauthorized permission was requested") even after the Org admin has approved the app through the Slack admin UI.

The root cause turned out to be a state divergence between the Slack admin UI ("権限を管理する → 保存") and the admin.apps.approved.list API record. The UI approval did not reflect in the API record, causing new user OAuth flows to fail with no recovery path visible to the admin.

We resolved this via admin.apps.approve API with the explicit bot_scopes parameter. Sharing the investigation in case other Enterprise Grid orgs hit the same issue.

Environment

• Slack plan: Enterprise Grid
• Claude app: official Marketplace install (A08SF47R6P4)
• "Pre-approved apps must be approved" mode: ON
• Affected users: new members not previously connected
• Working users: existing connected users (reconnect succeeded after admin UI "save permissions" action)

Symptom

1. Admin clicks "Manage Permissions" → "Save" in the Slack admin app management UI after a manifest update by Anthropic.
2. Existing users (who had connected previously) reconnect successfully.
3. New users see error: "承認されていない権限がリクエストされました" ("Unauthorized permission was requested").
4. The Slack OAuth consent screen shows ungreyed checkboxes (e.g., "あなたに代わりパブリックチャンネルの管理と新規作成を行う" = channels:write) which cannot be unchecked to pass through.
5. Uninstall → reinstall does not change the behavior.

Investigation

Created a small admin app with admin.apps:read + admin.apps:write scopes installed at the Enterprise Org level, then ran:

1. Check pending requests

POST https://slack.com/api/admin.apps.requests.list
  enterprise_id=<our org>

Result: empty array (no pending requests despite new users hitting the OAuth error).

2. Check approved scopes

POST https://slack.com/api/admin.apps.approved.list
  enterprise_id=<our org>

Result for A08SF47R6P4:

• date_updated: 2026-05-22 (about a month old, even though admin "Save" was clicked recently in the UI)
• 27 approved scopes
• All 27 were token_type: user — no bot scopes in record despite Slack OAuth v2 requiring bot scope approval for bot install.

3. Refresh via admin.apps.approve (no scope filter)

POST https://slack.com/api/admin.apps.approve
  app_id=A08SF47R6P4
  enterprise_id=<our org>

Result: {"ok": true}. After this:

• date_updated updated to current time.
• scope count: 27 → 57 (+30).
• 21 bot scopes appeared in the record (previously missing).
• 1 user scope (channels:write) was removed (likely a side effect of re-approval reflecting the current manifest state).

4. Capture the failing user's OAuth consent URL

Asked the affected user to copy the URL from the address bar of the consent screen (before clicking "Allow"):

https://d1ka.slack.com/oauth?client_id=1601185624273.8899143856786
  &scope=search:read.public search:read.private search:read.mpim search:read.im
         search:read.files search:read.users chat:write channels:history
         groups:history mpim:history im:history canvases:read canvases:write
         users:read users:read.email reactions:write reactions:read emoji:read
         files:read channels:write groups:write im:write mpim:write
         channels:read groups:read mpim:read
  &user_scope=
  &granular_bot_scope=1
  &redirect_uri=https://claude.ai/api/mcp/auth_callback
  ...

Two important facts from this URL:

• The app requests 26 bot scopes (all under scope=)
• user_scope= is empty and granular_bot_scope=1 is set
  • i.e., the official Claude Slack app uses granular bot scopes only; no user-token scopes are requested in this connector flow

5. Diff URL request vs approved.list

The 26 bot scopes requested by the OAuth URL vs the 24 bot scopes in approved.list (after step 3) revealed 9 missing bot scopes:

• canvases:write
• channels:write
• groups:write
• mpim:write
• search:read.files
• search:read.im
• search:read.mpim
• search:read.private
• search:read.users

Resolution

Explicitly approve the 9 missing bot scopes:

POST https://slack.com/api/admin.apps.approve
  app_id=A08SF47R6P4
  enterprise_id=<our org>
  bot_scopes=canvases:write,channels:write,groups:write,mpim:write,search:read.files,search:read.im,search:read.mpim,search:read.private,search:read.users

Response: {"ok": true}.

After this, approved.list contained all 26 bot scopes that the OAuth URL requests, and multiple new users were able to connect successfully through the standard OAuth flow.

Root cause analysis

Primary issue is on the Slack side: a state divergence between the admin UI's "Manage Permissions → Save" action and the internal admin.apps.approved.list record. The UI suggested success (no error message, "saved" indicator), but date_updated stayed unchanged and bot scopes never got registered in the API record. New user OAuth flows had no recovery path visible to the admin.

Secondary issue: the Slack admin UI's "Optional" section showed only links:read while the 9 missing bot scopes were completely invisible to the admin. There was no actionable way to discover or approve them through the UI.

For Anthropic — possible follow-ups

While the root cause is in Slack's admin tooling (UI ↔ API divergence), Anthropic could help affected Enterprise Grid orgs by:

1. Documenting the admin.apps.approve API workaround in the official Claude Slack connector troubleshooting docs (currently no Anthropic-side troubleshooting guide for this connector exists)
2. Surfacing a more actionable error message to end users — currently they see "unapproved permission" with no admin action path
3. Optionally sharing this investigation with the Slack team as a multi-customer regression

Related Issues

• [BUG] claude.ai Slack Connector returns no_bot_scopes_requested on Slack Enterprise Grid (admin/install verified) #1920 — Enterprise Grid no_bot_scopes_requested (still open)
• Slack Connector/Claude Slack App - bot_scopes_not_found when trying to create Slack canvas (canvases:write permission) #1633 — canvases:write bot_scopes_not_found (closed, related symptom)
• anthropics/claude-ai-mcp #443 — commands scope UI approval impossible (open)

Reproducer summary (for other affected admins)

1. Confirm: Slack plan = Enterprise Grid + "Pre-approved apps must be approved" mode ON
2. Have org admin click "Manage Permissions → Save" in the Slack admin UI for Claude (A08SF47R6P4)
3. Run admin.apps.approved.list?enterprise_id=... and check date_updated for Claude — if it does not match the recent admin UI action, you are hitting this issue
4. Capture a failing new user's OAuth consent URL → extract the scope= query parameter → diff against the bot scope set in approved.list
5. Apply the resolution above (admin.apps.approve with explicit bot_scopes)

---

Filed by an Enterprise Grid org admin after a long investigation today. Happy to share the full debug data privately if useful.

[ClayShentrup]

waiting with bated breath for this one.