Only administrators SHALL be allowed to consent to applications

Contributed by Michael Soule with Merill FernandoAll contributors →

Part of CISA · Entra ID · App consent and permissions · All checks

Run this check

Invoke-Maester -TestId CISA.MS.AAD.5.2

Overview

Only administrators SHALL be allowed to consent to applications.

Rationale: Limiting applications consent to only specific privileged users reduces risk of users giving insecure applications access to their data via consent grant attacks.

Remediation action

1. In Entra under Identity and Applications, select Enterprise applications.
2. Under Security, select Consent and permissions.
3. Under Manage, select User consent settings.
4. Under User consent for applications, select Do not allow user consent.
5. Click Save.

Related links

• Entra admin center - Consent and permissions | User consent settings
• CISA Application Registration & Consent - MS.AAD.5.2v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.AAD.5.2
Severity	High
Suite	CISA
Product	Entra ID
Feature	App consent and permissions
Area	Applications and workload identities
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1098.001 Additional Cloud Credentials, T1098.003 Additional Cloud Roles, T1528 Steal Application Access Token, T1566.002 Spearphishing Link
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.5.2
Criticality	SHALL
Upstream requirement	MS.AAD.5.2v1
Supports controls	cisa-scuba:MS.AAD.5.2, nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5
PowerShell test	Test-MtCisaAppUserConsent
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.5.2.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.5.2.md