Check ID: entra_policy_restricts_user_consent_for_apps
Provider: Microsoft 365
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra tenant settings restrict user consent to applications, preventing end users from granting delegated permissions to apps on their behalf. Only administrator-approved or policy-allowed consents are permitted.

​
Risk

Allowing end users to grant consent enables consent phishing and stealth access to mail, files, and directory data, impacting confidentiality and integrity. Attackers can obtain long-lived refresh tokens via offline_access, persist, and act as the user, evading detection.

​
Recommendation

Disable broad user consent and require admin approval for app permissions. If consent is needed, allow only verified publishers and low-impact scopes via app consent policies, and enable the admin consent workflow. Apply least privilege, review grants, and revoke unused consents regularly.

​
Remediation

az rest --method patch --url https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy --body "{\"defaultUserRolePermissions\":{\"permissionGrantPoliciesAssigned\":[\"ManagePermissionGrantsForOwnedResource.DeveloperConsent\"]}}"

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_policy_restricts_user_consent_for_apps. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks