Control: 5.1.5.2 Ensure user consent to apps accessing company data on their behalf is not allowed
Description
The admin consent workflow gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer takes action on the request, and the user is notified of the action.
The admin consent workflow (Preview) gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer acts on the request, and the user is notified of the action.
Remediation
To remediate using the UI:
- Navigate to
Microsoft Entra admin centerhttps://entra.microsoft.com/. - Click to expand
Identity>ApplicationsselectEnterprise applications. - Under Security select
Consent and permissions. - Under Manage select
Admin consent settings. - Set
Users can request admin consent to apps they are unable to consent totoYesunderAdmin consent requests. - Under the
Reviewerschoose the Roles and Groups that will review user generated app consent requests. - Set
Selected users will receive email notifications for requeststoYes. - Select
Saveat the top of the window.
Default Value
'- Users can request admin consent to apps they are unable to consent to: No
Selected users to review admin consent requests:NoneSelected users will receive email notifications for requests:YesSelected users will receive request expiration reminders:YesConsent request expires after (days):30.
Usage
Run the control in your terminal:
powerpipe control run microsoft365_compliance.control.cis_v400_5_1_5_2Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run microsoft365_compliance.control.cis_v400_5_1_5_2 --shareSQL
This control uses a named query:
select tenant_id || '/' || id as resource, case when jsonb_array_length(default_user_role_permissions -> 'permissionGrantPoliciesAssigned') = 0 then 'ok' else 'alarm' end as status, case when jsonb_array_length(default_user_role_permissions -> 'permissionGrantPoliciesAssigned') = 0 then tenant_id || ' which is ' || lower(split_part(description, '.', 1)) || ' does not have Permission Grant Policies assigned.' else tenant_id || ' which is ' || lower(split_part(description, '.', 1)) || ' have Permission Grant Policies assigned.' end as reason , tenant_id as tenant_idfrom azuread_authorization_policy;