Control: 2.7 Ensure user consent to apps accessing company data on their behalf is not allowed

Description

Control when end users and group owners are allowed to grant consent to applications, and when they will be required to request administrator review and approval. Allowing users to grant apps access to data helps them acquire useful applications and be productive, but can represent a risk in some situations if it's not monitored and controlled carefully.

Attackers commonly use custom applications to trick users into granting them access to company data. Disabling future user consent operations setting mitigates this risk, and helps to reduce the threat-surface. If user consent is disabled, previous consent grants will still be honored but all future consent operations must be performed by an administrator.

Remediation

To prohibit user consent to apps accessing company data on their behalf

1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
2. Click to expand Azure Active Directory > Applications select Enterprise applications.
3. Under Security select Consent and permissions.
4. Under User consent for applications select Do not allow user consent.
5. Click the Save option at the top of the window.

Default Value: UI - Allow user consent for apps.