M365 MCP admin-consent wall is self-serviceable on owned tenants

Graph-API MCPs such as @softeria/ms-365-mcp-server can fail login with "only an admin can grant permission" on tenants that block user consent. Don't write this off as blocked if the mailbox is on the user's own company domain, because they are probably the tenant admin. Run the server with --org-mode --login, sign in at the device-code URL, and tick "Consent on behalf of your organization". If the checkbox doesn't appear, try Entra admin center > Enterprise applications > the app > Grant admin consent. Keep scopes narrow with --preset mail,calendar --allowed-scopes "Mail.ReadWrite Mail.Send User.Read".