Control: 5.1.5.2 Ensure the admin consent workflow is enabled
Description
The admin consent workflow gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer takes action on the request, and the user is notified of the action.
Remediation
To remediate using the UI:
- Navigate to
Microsoft Entra admin centerhttps://entra.microsoft.com/. - Click to expand
Identity>ApplicationsselectEnterprise applications. - Under
SecurityselectConsent and permissions. - Under
ManageselectAdmin consent settings. - Set
Users can request admin consent to apps they are unable to consent totoYesunderAdmin consent requests. - Under the
Reviewerschoose the Roles and Groups that will review user generated app consent requests. - Set
Selected users will receive email notifications for requeststoYes. - Select
Saveat the top of the window.
To remediate using PowerShell:
The admin consent workflow configuration is currently only available through the Microsoft Entra admin center UI.
Default Value
Users can request admin consent to apps they are unable to consent to:NoSelected users to review admin consent requests:NoneSelected users will receive email notifications for requests:YesSelected users will receive request expiration reminders:YesConsent request expires after (days):30
Usage
Run the control in your terminal:
powerpipe control run microsoft365_compliance.control.cis_v500_5_1_5_2Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run microsoft365_compliance.control.cis_v500_5_1_5_2 --shareSQL
This control uses a named query:
select tenant_id || '/adminConsentRequestPolicy' as resource, case when is_enabled then 'ok' else 'alarm' end as status, case when is_enabled then tenant_id || ' has Admin Consent Workflow enabled.' else tenant_id || ' has Admin Consent Workflow disabled.' end as reason , tenant_id as tenant_idfrom azuread_admin_consent_request_policy;