Back to Checks
m365

Admin consent workflow is enabled

entra_admin_consent_workflow_enabled
Service: entraSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra admin consent workflow is evaluated to confirm an approval path exists for app permission requests. The check looks for the workflow being enabled and, when present, whether reviewer notifications are configured.

Prowler logoProwlerprowler-provider-m365

Risk

Without an approval workflow, app access decisions lack controlled review. This can force permissive settings or push users to shadow IT, enabling consent phishing and excessive Graph permissions that jeopardize confidentiality and integrity, or block required apps, affecting availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_admin_consent_workflow_enabled

Recommendation

Enable the admin consent workflow (Users can request admin consent to apps they are unable to consent to) and assign least-privileged reviewers; enable notifications and expiry. Combine with restrictive user consent policies, permission classifications, and periodic reviews. Apply least privilege and separation of duties.

Remediation

CLI

Update-MgPolicyAdminConsentRequestPolicy -IsEnabled:$true

Other

1Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as a Global Administrator
2Go to Entra ID > Enterprise applications > Consent and permissions > Admin consent settings
3Set "Users can request admin consent to apps they are unable to consent to" to Yes
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_admin_consent_workflow_enabled(Check):
    """
    Ensure the admin consent workflow is enabled in Microsoft Entra.

    This check verifies that the admin consent workflow is enabled in Microsoft Entra to allow users
    to request admin approval for applications requiring consent. Enabling the admin consent workflow
    ensures that applications which require additional permissions are only granted access after an
    administrator’s approval, reducing the risk of unauthorized access and work disruptions.

    The check fails if the admin consent workflow is not enabled, indicating that users might be blocked
    from accessing critical applications or forced to use insecure workarounds.
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the admin consent workflow requirement check.

        Retrieves the admin consent policy from the Microsoft Entra client and generates a report indicating
        whether the admin consent workflow is enabled.

        Returns:
            List[CheckReportM365]: A list containing the report with the result of the check.
        """
        findings = []
        admin_consent_policy = entra_client.admin_consent_policy
        if admin_consent_policy:
            report = CheckReportM365(
                self.metadata(),
                resource=admin_consent_policy,
                resource_name="Admin Consent Policy",
                resource_id=entra_client.tenant_domain,
            )
            report.status = "FAIL"
            report.status_extended = "The admin consent workflow is not enabled in Microsoft Entra; users may be blocked from accessing applications that require admin consent."
            if admin_consent_policy.admin_consent_enabled:
                report.status = "PASS"
                report.status_extended = "The admin consent workflow is enabled in Microsoft Entra, allowing users to request admin approval for applications."
                if admin_consent_policy.notify_reviewers:
                    report.status_extended += " Reviewers will be notified."
                else:
                    report.status_extended += (
                        " Reviewers will not be notified, we recommend notifying them."
                    )

            findings.append(report)
        return findings

References