cirsec Baselines
Esc
Microsoft 365 tenant · Applications, consent & AI agents

Keep risk-based step-up consent enabled

When it fails: Users can consent to applications that Microsoft flags as risky. Risk-based step-up consent is turned off, so a user can approve a consent request that Microsoft detected as risky instead of having it sent to an administrator.

CB-M365-APPS-003mediumactivemanualprofile baseline

Description

The directory setting Consent Policy Settings keeps BlockUserConsentForRiskyApps set to True. When Microsoft detects a risky user consent request (for example a newly registered, unverified multitenant application asking for non-basic permissions), the request steps up to admin consent instead of being granted by the user.

If the Consent Policy Settings object was never created in the tenant, the template value (True) applies. The setting has no admin center page: it is read and changed with Microsoft Graph only.

Rationale

The protection is on by default and only matters while user consent is allowed (CB-M365-APPS-002 with low-risk). Turning it off removes Microsoft's detection of malicious consent requests, which is an effective layer against consent phishing campaigns that use fresh applications.

Impact

None known. Users who hit a risky request see that admin approval is needed and can send a request through the admin consent workflow (CB-M365-APPS-005).

Setting

LocationMicrosoft Graph directory setting "Consent Policy Settings" (template dffd5d46-495d-40a9-8e21-954ff55e198a), value BlockUserConsentForRiskyApps
DefaultTrue
RecommendedTrue

Audit

  1. Connect to Microsoft Graph PowerShell (beta module) as at least a Global Reader with the Directory.Read.All scope.
  2. Run: Get-MgBetaDirectorySetting -All | Where-Object TemplateId -eq 'dffd5d46-495d-40a9-8e21-954ff55e198a' | Select-Object -ExpandProperty Values or call Graph GET https://graph.microsoft.com/beta/settings.
  3. If no object is returned, the default applies (True) and the control passes.
  4. Fail if BlockUserConsentForRiskyApps is False.

Remediation

  1. Connect to Microsoft Graph PowerShell (beta module) as a Privileged Role Administrator with the Directory.ReadWrite.All scope.
  2. Read the existing Consent Policy Settings object and keep its other values (EnableGroupSpecificConsent, ConstrainGroupSpecificConsentToMembersOfGroupId, EnableAdminConsentRequests...).
  3. Set BlockUserConsentForRiskyApps to True with Update-MgBetaDirectorySetting -DirectorySettingId <id> -BodyParameter <values>, passing every value of the object.

Rollback

Set BlockUserConsentForRiskyApps back to its previous value.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1CM-11related
NIST SP 800-53 Rev. 55.1.1SI-4related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1528

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr