Back to Checks
m365

User consent for applications is set to 'Do not allow user consent'

entra_policy_restricts_user_consent_for_apps
Service: entraSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra tenant settings restrict user consent to applications, preventing end users from granting delegated permissions to apps on their behalf. Only administrator-approved or policy-allowed consents are permitted.

Prowler logoProwlerprowler-provider-m365

Risk

Allowing end users to grant consent enables consent phishing and stealth access to mail, files, and directory data, impacting confidentiality and integrity. Attackers can obtain long-lived refresh tokens via offline_access, persist, and act as the user, evading detection.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_policy_restricts_user_consent_for_apps

Recommendation

Disable broad user consent and require admin approval for app permissions. If consent is needed, allow only verified publishers and low-impact scopes via app consent policies, and enable the admin consent workflow. Apply least privilege, review grants, and revoke unused consents regularly.

Remediation

CLI

az rest --method patch --url https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy --body "{\"defaultUserRolePermissions\":{\"permissionGrantPoliciesAssigned\":[\"ManagePermissionGrantsForOwnedResource.DeveloperConsent\"]}}"

Other

1Sign in to the Microsoft Entra admin center (https://entra.microsoft.com)
2Go to Identity > Applications > Enterprise applications
3Select Consent and permissions > User consent settings
4Under User consent for applications, select Do not allow user consent
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_policy_restricts_user_consent_for_apps(Check):
    """Check if the authorization policy restricts users from consenting apps.

    This check verifies whether the default user role permissions in Microsoft Entra
    prevent users from consenting to apps that access company data on their behalf.
    If such consent is disabled, the check passes.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for user consent restrictions.

        Returns:
            List[CheckReportM365]: A list containing the result of the check.
        """
        findings = []
        auth_policy = entra_client.authorization_policy

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=auth_policy if auth_policy else {},
            resource_name=auth_policy.name if auth_policy else "Authorization Policy",
            resource_id=auth_policy.id if auth_policy else "authorizationPolicy",
        )
        report.status = "FAIL"
        report.status_extended = (
            "Entra allows users to consent apps accessing company data on their behalf."
        )

        if getattr(auth_policy, "default_user_role_permissions", None) and not any(
            "ManagePermissionGrantsForSelf" in policy_assigned
            for policy_assigned in getattr(
                auth_policy.default_user_role_permissions,
                "permission_grant_policies_assigned",
                ["ManagePermissionGrantsForSelf.microsoft-user-default-legacy"],
            )
        ):
            report.status = "PASS"
            report.status_extended = "Entra does not allow users to consent apps accessing company data on their behalf."

        findings.append(report)
        return findings

References