{
  "id": "CB-M365-APPS-003",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-003",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-003.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-003.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-APPS-003",
    "title": "Keep risk-based step-up consent enabled",
    "finding": {
      "title": "Users can consent to applications that Microsoft flags as risky",
      "description": "Risk-based step-up consent is turned off, so a user can approve a consent request that Microsoft detected as risky instead of having it sent to an administrator."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "applications",
      "consent",
      "illicit-consent",
      "oauth",
      "entra-id"
    ],
    "description": "The directory setting **Consent Policy Settings** keeps `BlockUserConsentForRiskyApps` set to\n`True`. When Microsoft detects a risky user consent request (for example a newly registered,\nunverified multitenant application asking for non-basic permissions), the request steps up to\nadmin consent instead of being granted by the user.\n",
    "rationale": "The protection is on by default and only matters while user consent is allowed\n(CB-M365-APPS-002 with `low-risk`). Turning it off removes Microsoft's detection of malicious\nconsent requests, which is an effective layer against consent phishing campaigns that use fresh\napplications.\n",
    "impact": "None known. Users who hit a risky request see that admin approval is needed and can send a\nrequest through the admin consent workflow (CB-M365-APPS-005).\n",
    "notes": "If the **Consent Policy Settings** object was never created in the tenant, the template value\n(`True`) applies. The setting has no admin center page: it is read and changed with Microsoft\nGraph only.\n",
    "setting": {
      "location": "Microsoft Graph directory setting \"Consent Policy Settings\" (template dffd5d46-495d-40a9-8e21-954ff55e198a), value BlockUserConsentForRiskyApps",
      "default_value": "True",
      "recommended_value": "True"
    },
    "audit": {
      "manual": "1. Connect to Microsoft Graph PowerShell (beta module) as at least a Global Reader with the\n   `Directory.Read.All` scope.\n2. Run:\n   `Get-MgBetaDirectorySetting -All | Where-Object TemplateId -eq 'dffd5d46-495d-40a9-8e21-954ff55e198a' | Select-Object -ExpandProperty Values`\n   or call Graph `GET https://graph.microsoft.com/beta/settings`.\n3. If no object is returned, the default applies (`True`) and the control passes.\n4. Fail if `BlockUserConsentForRiskyApps` is `False`.\n"
    },
    "remediation": {
      "manual": "1. Connect to Microsoft Graph PowerShell (beta module) as a Privileged Role Administrator with\n   the `Directory.ReadWrite.All` scope.\n2. Read the existing **Consent Policy Settings** object and keep its other values\n   (`EnableGroupSpecificConsent`, `ConstrainGroupSpecificConsentToMembersOfGroupId`,\n   `EnableAdminConsentRequests`...).\n3. Set `BlockUserConsentForRiskyApps` to `True` with `Update-MgBetaDirectorySetting\n   -DirectorySettingId <id> -BodyParameter <values>`, passing every value of the object.\n",
      "rollback": "Set `BlockUserConsentForRiskyApps` back to its previous value.\n"
    },
    "references": [
      {
        "title": "Configure risk-based step-up consent",
        "url": "https://learn.microsoft.com/entra/identity/enterprise-apps/configure-risk-based-step-up-consent",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-11",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1528"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-APPS-002",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-005",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}