Back to Checks
azure

Entra authorization policy disallows user consent for applications

entra_policy_restricts_user_consent_for_apps
Service: entraSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra authorization settings are evaluated to determine if the default user role permits user consent to applications. The check looks at permission grant policies to see whether end users can authorize apps to access organization data on their behalf, or if consent is restricted (e.g., Do not allow user consent).

Prowler logoProwlerprowler-provider-azure

Risk

Permitting end-user consent enables consent phishing and over-privileged OAuth grants. Attackers can obtain tokens to read/send mail, access files, or act as the user, causing data exfiltration, persistence beyond password resets/MFA changes, and abuse of connected apps, impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_policy_restricts_user_consent_for_apps

Recommendation

Enforce least privilege by setting user consent to Do not allow user consent. Use the admin consent workflow to review requests and pre-approve only vetted apps. If needed, allow consent only for verified publishers with low-impact scopes. Regularly review existing grants and monitor audit/sign-in logs.

Remediation

CLI

Update-MgPolicyAuthorizationPolicy -BodyParameter @{ permissionGrantPolicyIdsAssignedToDefaultUserRole = @() }

Terraform

resource "azuread_authorization_policy" "<example_resource_name>" {
  # Critical: remove all self-consent policies so users cannot consent to apps
  permission_grant_policy_ids_assigned_to_default_user_role = []
}

Other

1Sign in to the Microsoft Entra admin center (entra.microsoft.com) with a Global Administrator
2Go to Identity > Applications > Enterprise applications
3Select Consent and permissions > User consent settings
4Choose Do not allow user consent
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_policy_restricts_user_consent_for_apps(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for tenant_domain, auth_policy in entra_client.authorization_policy.items():
            report = Check_Report_Azure(metadata=self.metadata(), resource=auth_policy)
            report.subscription = f"Tenant: {tenant_domain}"
            report.resource_name = getattr(auth_policy, "name", "Authorization Policy")
            report.resource_id = auth_policy.id
            report.status = "FAIL"
            report.status_extended = "Entra allows users to consent apps accessing company data on their behalf"

            if getattr(auth_policy, "default_user_role_permissions", None) and not any(
                "ManagePermissionGrantsForSelf" in policy_assigned
                for policy_assigned in getattr(
                    auth_policy.default_user_role_permissions,
                    "permission_grant_policies_assigned",
                    ["ManagePermissionGrantsForSelf.microsoft-user-default-legacy"],
                )
            ):
                report.status = "PASS"
                report.status_extended = "Entra does not allow users to consent apps accessing company data on their behalf"

            findings.append(report)

        return findings

References