Check ID: entra_admin_consent_workflow_enabled
Provider: Microsoft 365
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra admin consent workflow is evaluated to confirm an approval path exists for app permission requests. The check looks for the workflow being enabled and, when present, whether reviewer notifications are configured.

​
Risk

Without an approval workflow, app access decisions lack controlled review. This can force permissive settings or push users to shadow IT, enabling consent phishing and excessive Graph permissions that jeopardize confidentiality and integrity, or block required apps, affecting availability.

​
Recommendation

Enable the admin consent workflow (Users can request admin consent to apps they are unable to consent to) and assign least-privileged reviewers; enable notifications and expiry. Combine with restrictive user consent policies, permission classifications, and periodic reviews. Apply least privilege and separation of duties.

​
Remediation

Update-MgPolicyAdminConsentRequestPolicy -IsEnabled:$true

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_admin_consent_workflow_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks