Users cannot consent to non-verified applications

Check ID: entra_policy_user_consent_for_verified_apps
Provider: Azure
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

What this check verifies

Microsoft Entra authorization policy for the default user role is assessed for assignment of the user-consent policy microsoft-user-default-legacy. Its presence means users can self-consent to app permissions; its absence indicates consent is restricted (e.g., only verified publishers or low-impact scopes).

Risk

Broad self-consent enables OAuth consent phishing and rogue apps to gain tokens to tenant data (confidentiality), request write scopes to change resources (integrity), and persist via refresh tokens after password changes. Mis-scoped grants can drive lateral movement and privilege escalation.

Recommendation

Enforce least privilege for app consent:

Remove microsoft-user-default-legacy
Allow consent only for verified publishers and low-impact permissions (e.g., microsoft-user-default-low)
Require admin approval for higher-risk scopes via the admin consent workflow
Periodically review and revoke unused consent grants

Remediation

CLI
Terraform
Dashboard steps

Update-MgPolicyAuthorizationPolicy -BodyParameter @{permissionGrantPolicyIdsAssignedToDefaultUserRole=@('ManagePermissionGrantsForSelf.microsoft-user-default-low')}

resource "azuread_authorization_policy" "<example_resource_name>" {
  # Critical: restricts user consent to verified publishers with low-impact permissions only
  permission_grant_policy_ids_assigned_to_default_user_role = ["ManagePermissionGrantsForSelf.microsoft-user-default-low"]
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_policy_user_consent_for_verified_apps. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Entra policy disallows user consent for applications Privileged user has multi-factor authentication enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires