Enable the admin consent request workflow

Description

The admin consent workflow is on. Users who cannot consent to an application send a request with a justification. Named reviewers (a group or roles, never a single person) receive an email for each request and an expiration reminder, and requests expire after {{ admin_consent_request_expiry_days }} days at most.

Rationale

Restricting user consent (CB-M365-APPS-002) only holds if users have a legitimate path to ask for an application. The workflow records who asked, why, and who approved, and puts a security review before any grant of tenant data. Short expiration keeps stale requests from being approved months later without context.

Impact

Reviewers must handle requests in a reasonable time. Only Global Administrators (or Privileged Role Administrators for delegated permissions) can approve requests for Microsoft Graph application permissions; other reviewers can still review, deny or block.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Enterprise apps > Consent and permissions > Admin consent settings.
3. Check that:
   • Users can request admin consent to apps they are unable to consent to is Yes;
   • Who can review admin consent requests lists at least one group or role with active members (or several named users);
   • Selected users will receive email notifications for requests is Yes;
   • Selected users will receive request expiration reminders is Yes;
   • Consent request expires after (days) is at most {{ admin_consent_request_expiry_days }}.
4. Alternative with Graph (scope Policy.Read.All): GET https://graph.microsoft.com/v1.0/policies/adminConsentRequestPolicy, or Get-MgPolicyAdminConsentRequestPolicy; check isEnabled, reviewers, notifyReviewers, remindersEnabled and requestDurationInDays.
5. Fail if the workflow is off, has no reviewer, has notifications or reminders off, or keeps requests longer than {{ admin_consent_request_expiry_days }} days.

Remediation

1. Create or pick a group of reviewers from the team that manages applications and security.
2. Sign in to the Microsoft Entra admin center as a Global Administrator (or update the policy through Graph as a Privileged Role Administrator).
3. Browse to Entra ID > Enterprise apps > Consent and permissions > Admin consent settings.
4. Set Users can request admin consent to apps they are unable to consent to to Yes, add the reviewers, turn on email notifications and expiration reminders, and set Consent request expires after (days) to {{ admin_consent_request_expiry_days }} or less.
5. Select Save. The workflow can take up to an hour to become active.
6. Graph alternative (scope Policy.ReadWrite.ConsentRequest): PUT https://graph.microsoft.com/v1.0/policies/adminConsentRequestPolicy with isEnabled, notifyReviewers, remindersEnabled, requestDurationInDays and reviewers.

Rollback

Set Users can request admin consent to apps they are unable to consent to to No.

References

• Configure the admin consent workflow Microsoft, vendor-doc, accessed 2026-10-24
• Review admin consent requests Microsoft, vendor-doc, accessed 2026-10-24
• adminConsentRequestPolicy resource type Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-APPS-002 Restrict user consent to applications
• related CB-M365-APPS-003 Keep risk-based step-up consent enabled

People and lifecycle