Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes

Contributed by Thomas NaunheimAll contributors →

Part of Entra ID SCA · Entra ID · App consent and permissions · All checks

Run this check

Invoke-Maester -TestId EIDSCA.CR05

Overview

Checks that the enabled admin consent workflow has at least one reviewer scope and that every scope has a MicrosoftGraph query with a structurally valid absolute or rooted relative path. A null queryRoot is valid for absolute paths. This structural check does not execute queries, resolve membership, or establish reviewer availability or approval permissions.

Configure at least one reviewer scope with a nonempty MicrosoftGraph query. Absolute Graph-relative queries do not require queryRoot; relative queries require the supported queryRoot. Separately resolve group membership and role assignments to verify that usable reviewers and an appropriate approval path exist. Being designated a reviewer does not grant consent permissions.

Test script

https://graph.microsoft.com/beta/policies/adminConsentRequestPolicy
.reviewers.Count -gt 0 -and @($result.reviewers -eq 'true'

Remediation action

In Enterprise apps > Consent and permissions > Admin consent settings, configure the users, groups, or roles that can review requests. See Microsoft Learn - Configure the admin consent workflow.

Related links

• Open in Graph Explorer
• adminConsentRequestPolicy resource type - Microsoft Graph v1.0 | Microsoft Learn
• View in Microsoft Entra admin center

MITRE ATT&CK

mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0001 - Initial Access - Initial Access
      TA0005 - Defense Evasion - Stealth
      TA0006 - Credential Access - Credential Access
      TA0008 - Lateral Movement - Lateral Movement
    (Mitigation)
      M1018 - User Account Management
      M1017 - User Training
    (Technique)
      T1078 - Valid Accounts
      T1528 - Steal Application Access Token
      T1550 - Use Alternate Authentication Material
      T1550.001 - Use Alternate Authentication Material: Application Access Token
      T1566.002 - Phishing: Spearphishing Link

Tactic	Technique	Mitigation
TA0001 - Initial Access - Initial Access TA0005 - Defense Evasion - Stealth TA0006 - Credential Access - Credential Access TA0008 - Lateral Movement - Lateral Movement	T1078 - Valid Accounts T1528 - Steal Application Access Token T1550 - Use Alternate Authentication Material T1550.001 - Use Alternate Authentication Material: Application Access Token T1566.002 - Phishing: Spearphishing Link	M1018 - User Account Management M1017 - User Training

Details

Every attribute of this check

Field	Value
Test ID	EIDSCA.CR05
Severity	Low
Suite	Entra ID SCA
Product	Entra ID
Feature	App consent and permissions
Area	Applications and workload identities
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
PowerShell test	Test-MtCheckEidscaCR05
Services	Graph

Source

• Test: tests/eidsca/Test.EIDSCA.CR05.ps1
• Documentation: tests/eidsca/Test.EIDSCA.CR05.md