Noone may ask for a customer's username and password to gain access to the tenant's resources. Everyone must adhere to the following authorization sequence.
Post-approval
The user who approved the application appears in the App Store with the date the application was added.
A customer's administrator may authorize the application by clicking a link that includes your client ID. This will show the consent dialog for the application and as an administrator, they may click I approve.