cirsec Baselines
Esc
Microsoft 365 tenant · Applications, consent & AI agents

Prevent group owners from consenting to applications for their groups

When it fails: Group owners can grant applications access to their group's data. The owner of a Microsoft 365 group or team, often a regular user, can approve an application that then reads the group's files, conversations and calendar.

CB-M365-APPS-004mediumactivemanualprofile baseline

Description

Group owners cannot grant resource-specific consent to applications for the groups or teams they own. No ManagePermissionGrantsForOwnedResource.* group consent policy is assigned to the default user role, and the legacy directory setting EnableGroupSpecificConsent is False.

Microsoft moved this setting from the legacy Consent Policy Settings directory object to app consent policies. Check both places: some tenants still carry the legacy value.

Rationale

Group-specific consent bypasses the tenant consent settings for the data of a group: an owner tricked by a consent phishing link exposes every file and message of the group, even when user consent is restricted (CB-M365-APPS-002). Group owners are not vetted like administrators, and in most tenants any user can create a group and become its owner.

Impact

Teams apps that need resource-specific consent (RSC) permissions on a team must be approved by an administrator. Teams app permission policies and the Teams admin center keep working.

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to Entra ID > Enterprise apps > Consent and permissions > User consent settings and check that Group owner consent for apps accessing data is set to Do not allow group owner consent (when the section is shown).
  3. In Microsoft Graph PowerShell (scope Policy.Read.All), run (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.PermissionGrantPoliciesAssigned and look for entries starting with ManagePermissionGrantsForOwnedResource. that point to a group consent policy (for example microsoft-all-application-permissions-for-group or microsoft-pre-approval-apps-for-group).
  4. Run Get-MgBetaDirectorySetting -All | Where-Object TemplateId -eq 'dffd5d46-495d-40a9-8e21-954ff55e198a' | Select-Object -ExpandProperty Values and read EnableGroupSpecificConsent.
  5. Fail if a group consent policy is assigned to the default user role, or if EnableGroupSpecificConsent is True.

Remediation

  1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator (Global Administrator for the portal page).
  2. Browse to Entra ID > Enterprise apps > Consent and permissions > User consent settings, select Do not allow group owner consent and select Save.
  3. In Microsoft Graph PowerShell (scope Policy.ReadWrite.Authorization), read PermissionGrantPoliciesAssigned, remove the group consent entries and keep the others, then apply the list with Update-MgPolicyAuthorizationPolicy.
  4. If the legacy Consent Policy Settings object exists, set EnableGroupSpecificConsent to False with Update-MgBetaDirectorySetting, passing all its other values unchanged.

Rollback

Restore the previous group owner consent option.

References

Mappings

FrameworkIDRelationNote
NIST SP 800-53 Rev. 55.1.1AC-6related
NIST SP 800-53 Rev. 55.1.1CM-11related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.AAD.5.4v1equivalentPolicy withdrawn from SCuBA 2.0; kept here because the exposure still exists.

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1528

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr