Back to Checks
azure

Entra tenant does not allow users to consent to non-verified applications

entra_policy_user_consent_for_verified_apps
Service: entraSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra authorization policy for the default user role is assessed for assignment of the user-consent policy microsoft-user-default-legacy. Its presence means users can self-consent to app permissions; its absence indicates consent is restricted (e.g., only verified publishers or low-impact scopes).

Prowler logoProwlerprowler-provider-azure

Risk

Broad self-consent enables OAuth consent phishing and rogue apps to gain tokens to tenant data (confidentiality), request write scopes to change resources (integrity), and persist via refresh tokens after password changes. Mis-scoped grants can drive lateral movement and privilege escalation.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_policy_user_consent_for_verified_apps

Recommendation

Enforce least privilege for app consent:

  • Remove microsoft-user-default-legacy
  • Allow consent only for verified publishers and low-impact permissions (e.g., microsoft-user-default-low)
  • Require admin approval for higher-risk scopes via the admin consent workflow
  • Periodically review and revoke unused consent grants

Remediation

CLI

Update-MgPolicyAuthorizationPolicy -BodyParameter @{permissionGrantPolicyIdsAssignedToDefaultUserRole=@('ManagePermissionGrantsForSelf.microsoft-user-default-low')}

Terraform

resource "azuread_authorization_policy" "<example_resource_name>" {
  # Critical: restricts user consent to verified publishers with low-impact permissions only
  permission_grant_policy_ids_assigned_to_default_user_role = ["ManagePermissionGrantsForSelf.microsoft-user-default-low"]
}

Other

1Sign in to Microsoft Entra admin center as Global Administrator or Privileged Role Administrator
2Go to Identity > Applications > Enterprise applications
3Select Consent and permissions > User consent settings
4Under User consent for applications, select "Allow user consent for apps from verified publishers, for selected permissions"
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_policy_user_consent_for_verified_apps(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for tenant_domain, auth_policy in entra_client.authorization_policy.items():
            report = Check_Report_Azure(metadata=self.metadata(), resource=auth_policy)
            report.subscription = f"Tenant: {tenant_domain}"
            report.resource_name = getattr(auth_policy, "name", "Authorization Policy")
            report.resource_id = auth_policy.id
            report.status = "PASS"
            report.status_extended = "Entra does not allow users to consent non-verified apps accessing company data on their behalf."

            if getattr(auth_policy, "default_user_role_permissions", None) and any(
                "ManagePermissionGrantsForSelf.microsoft-user-default-legacy"
                in policy_assigned
                for policy_assigned in getattr(
                    auth_policy.default_user_role_permissions,
                    "permission_grant_policies_assigned",
                    ["ManagePermissionGrantsForSelf.microsoft-user-default-legacy"],
                )
            ):
                report.status = "FAIL"
                report.status_extended = "Entra allows users to consent apps accessing company data on their behalf."

            findings.append(report)

        return findings

References