cirsec Baselines
Esc
Microsoft 365 tenant · Applications, consent & AI agents

Restrict user consent to applications

When it fails: Users can grant any application access to organizational data. An attacker can send a consent link for a malicious multitenant application and obtain a token to the victim's mail, files or directory data without ever knowing a password.

CB-M365-APPS-002highactivemanualprofile baseline

Description

User consent to applications is limited by the {{ user_consent }} level:

  • low-risk: users can consent only to applications from verified publishers or registered in the tenant, and only for permissions classified as low impact (built-in policy microsoft-user-default-low);
  • none: users cannot consent to any application; every request goes to an administrator through the admin consent workflow (CB-M365-APPS-005).

The legacy setting Allow user consent for apps (microsoft-user-default-legacy) is never used.

Existing grants are not removed when the setting changes. Review them under Enterprise apps > Permissions and revoke those that are not needed (CB-M365-APPS-011).

Rationale

Illicit consent grant is a phishing technique that skips the password and MFA entirely: the victim signs in on the real Microsoft page and approves permissions for the attacker's application, which then keeps a refresh token. Limiting consent to verified publishers and low-impact permissions removes most of these lures; removing user consent entirely removes all of them.

Impact

With low-risk, users can still connect common applications that ask only for sign-in and basic profile permissions. Classify the low-impact permissions first (Permission classifications), otherwise the list is empty and every request needs an administrator. With none, each new application needs an administrator decision: size the review team before switching.

Setting

LocationEntra admin center > Entra ID > Enterprise apps > Consent and permissions > User consent settings (Graph authorizationPolicy.defaultUserRolePermissions.permissionGrantPoliciesAssigned)
DefaultAllow user consent for apps from verified publishers, for selected permissions (Microsoft-managed recommendation in recent tenants)
Recommended{{ user_consent }}

Parameters

ParameterBaselineHardenedBounds

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to Entra ID > Enterprise apps > Consent and permissions > User consent settings.
  3. Check User consent for applications:
    • for low-risk: Allow user consent for apps from verified publishers, for selected permissions or Do not allow user consent;
    • for none: Do not allow user consent.
  4. With low-risk, open Permission classifications and check that only low-impact delegated permissions (for example openid, profile, email, offline_access, User.Read) are listed.
  5. Alternative in Microsoft Graph PowerShell (scope Policy.Read.All): (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.PermissionGrantPoliciesAssigned. Entries starting with ManagePermissionGrantsForSelf. define user consent: microsoft-user-default-low matches low-risk; no such entry matches none.
  6. Fail if Allow user consent for apps is selected (microsoft-user-default-legacy), if a custom ManagePermissionGrantsForSelf.* policy is broader than low-impact permissions, or if the level is looser than {{ user_consent }}.

Remediation

  1. Turn on the admin consent workflow first (CB-M365-APPS-005) so that blocked users can ask for access.
  2. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator (Global Administrator is required for the portal page).
  3. For low-risk, browse to Entra ID > Enterprise apps > Consent and permissions > Permission classifications and add the low-impact delegated permissions.
  4. Browse to User consent settings and select Allow user consent for apps from verified publishers, for selected permissions (low-risk) or Do not allow user consent (none). Select Save.
  5. Alternative in Microsoft Graph PowerShell (scope Policy.ReadWrite.Authorization): read the current PermissionGrantPoliciesAssigned, keep the ManagePermissionGrantsForOwnedResource.* entries, and set the ManagePermissionGrantsForSelf.* entry to ManagePermissionGrantsForSelf.microsoft-user-default-low (or remove it for none) with Update-MgPolicyAuthorizationPolicy.

Rollback

Select the previous consent option. Do not return to Allow user consent for apps.

References

Mappings

FrameworkIDRelationNote
NIST SP 800-53 Rev. 55.1.1AC-6related
NIST SP 800-53 Rev. 55.1.1CM-11related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.AAD.5.2v1equivalent

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1528
MITRE ATT&CKT1566

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr