Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
entra_policy_restricts_user_consent_for_appsProvider: Azure
Service:
entraSeverity: HIGH
Categories:
identity-access, e3Resource type:
NotDefinedWhat this check verifies
Microsoft Entra authorization settings are evaluated to determine if the default user role permits user consent to applications. The check looks at permission grant policies to see whether end users can authorize apps to access organization data on their behalf, or if consent is restricted (e.g.,Do not allow user consent).
Risk
Permitting end-user consent enables consent phishing and over-privileged OAuth grants. Attackers can obtain tokens to read/send mail, access files, or act as the user, causing data exfiltration, persistence beyond password resets/MFA changes, and abuse of connected apps, impacting confidentiality and integrity.Recommendation
Enforce least privilege by setting user consent toDo not allow user consent. Use the admin consent workflow to review requests and pre-approve only vetted apps. If needed, allow consent only for verified publishers with low-impact scopes. Regularly review existing grants and monitor audit/sign-in logs.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-1-separate-and-limit-highly-privilegedadministrative-users
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/azure/ActiveDirectory/users-can-consent-to-apps-accessing-company-data-on-their-behalf.html#
- https://learn.microsoft.com/en-gb/entra/identity/enterprise-apps/configure-user-consent?pivots=portal
- https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = entra_policy_restricts_user_consent_for_apps. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks