Group owners SHALL NOT be allowed to consent to applications
Part of CISA · Entra ID · App consent and permissions · All checks
Invoke-Maester -TestId CISA.MS.AAD.5.4Overview
Section titled “Overview”This test is deprecated by CISA as of March 2025 and will always be skipped. The content below is retained as a historical archive and will be removed in a future version.
MS.AAD.5.4v1 was removed because Microsoft announced via MC712143 that group owner consent to applications is no longer a configurable setting. The setting has been removed from the product entirely, making the policy moot. See CISA SCuBA Removed Policies — MS.AAD.5.4v1.
Group owners SHALL NOT be allowed to consent to applications.
Rationale: In M365, group owners and team owners can consent to applications accessing data in the tenant. By requiring consent requests to go through an approval workflow, risk of exposure to malicious applications is reduced.
Remediation action:
Section titled “Remediation action:”- In Entra under Identity and Applications, select Enterprise applications.
- Under Security, select Consent and permissions.
- Under Manage, select User consent settings.
- Under Group owner consent for apps accessing data, select Do not allow group owner consent.
- Click Save.
Related links
Section titled “Related links”- Entra admin center - Consent and permissions | User consent settings
- CISA Application Registration & Consent - MS.AAD.5.4v1
- CISA ScubaGear Rego Reference
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CISA.MS.AAD.5.4 |
| Severity | High |
| Suite | CISA |
| Product | Entra ID |
| Feature | App consent and permissions |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1566.002 Spearphishing Link |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.5.4 |
| Criticality | SHALL |
| Supports controls | cisa-scuba:MS.AAD.5.4 |
| PowerShell test | Test-MtCisaAppGroupOwnerConsent |
| Services | Graph |
| Lifecycle | Deprecated |
Source
Section titled “Source”- Test:
tests/cisa/entra/Test.CISA.MS.AAD.5.4.ps1 - Documentation:
tests/cisa/entra/Test.CISA.MS.AAD.5.4.md