# (L2) Ensure user consent to apps accessing company data on their behalf is not allowed

5.1.5.1 (L2) Ensure user consent to apps accessing company data on their behalf is not allowed

Source: https://maester.dev/docs/tests/CIS.M365.5.1.5.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/oed-metzb" title="Benjamin Metz · Original author"><img src="https://github.com/oed-metzb.png" alt="Benjamin Metz" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/mynster9361" title="-Mynster · Co-contributor"><img src="https://github.com/Mynster9361.png" alt="-Mynster" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/oed-metzb">Benjamin Metz</a> with <a href="/contributors/mynster9361">-Mynster</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · App consent and permissions · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.1.5.1
```

## Overview

5.1.5.1 (L2) Ensure user consent to apps accessing company data on their behalf is not allowed

Control when end users and group owners are allowed to grant consent to applications, and when they will be required to request administrator review and approval. Allowing users to grant apps access to data helps them acquire useful applications and be productive but can represent a risk in some situations if it's not monitored and controlled carefully.

#### Rationale

Attackers commonly use custom applications to trick users into granting them access to company data. Restricting user consent mitigates this risk and helps to reduce the threat-surface.

#### Impact

If user consent is disabled, previous consent grants will still be honored but all future consent operations must be performed by an administrator. Tenant-wide admin consent can be requested by users through an integrated administrator consent request workflow or through organizational support processes

#### Remediation action

1. Navigate to [Microsoft 365 Entra admin center](https://entra.microsoft.com).
2. Click to expand **Entra ID** and select **Enterprise apps**.
3. Under **Security** select **Consent and permissions** > **User consent settings**.
4. Under **User consent for applications** select **Do not allow user consent**.
5. Click the **Save** option at the top of the window.

#### Related links

* [Microsoft 365 Entra admin center](https://entra.microsoft.com)
* [Configure how users consent to applications](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-user-consent?pivots=portal)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 239](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.1.5.1 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | App consent and permissions |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1566.002 Spearphishing Link |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.5.1 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2, E5 Level 2 |
| Supports controls | cis-m365:5.1.5.1, nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5 |
| PowerShell test | [Test-MtCisEnsureUserConsentToAppsDisallowed](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.1.5.1.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.1.5.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.1.5.1.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.1.5.1.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.1.5.1.md)