Skip to main content
Version: 2.1.1-preview

CIS.M365.5.1.5.1 - Ensure user consent to apps accessing company data on their behalf is not allowed

Overview​

5.1.5.1 (L2) Ensure user consent to apps accessing company data on their behalf is not allowed

Control when end users and group owners are allowed to grant consent to applications, and when they will be required to request administrator review and approval. Allowing users to grant apps access to data helps them acquire useful applications and be productive but can represent a risk in some situations if it's not monitored and controlled carefully.

Rationale​

Attackers commonly use custom applications to trick users into granting them access to company data. Restricting user consent mitigates this risk and helps to reduce the threat-surface.

Impact​

If user consent is disabled, previous consent grants will still be honored but all future consent operations must be performed by an administrator. Tenant-wide admin consent can be requested by users through an integrated administrator consent request workflow or through organizational support processes

Remediation action:​

  1. Navigate to Microsoft 365 Entra admin center.
  2. Click to expand Entra ID and select Enterprise apps.
  3. Under Security select Consent and permissions > User consent settings.
  4. Under User consent for applications select Do not allow user consent.
  5. Click the Save option at the top of the window.

Test Metadata​

FieldValue
Test IDCIS.M365.5.1.5.1
SeverityUnknown
SuiteCIS
CategoryCIS E3 Level 2
PowerShell testTest-MtCisEnsureUserConsentToAppsDisallowed
TagsCIS, CIS E3, CIS E3 Level 2, CIS E5, CIS E5 Level 2, CIS M365 v6.0.1, CIS.M365.5.1.5.1, L2, Security

Source​

  • Pester test: tests/cis/Test-MtCisEnsureUserConsentToAppsDisallowed.Tests.ps1
  • PowerShell source: powershell/public/cis/Test-MtCisEnsureUserConsentToAppsDisallowed.ps1