Admin consent workflow is enabled

Maester checks this too

CIS.M365.5.1.5.2 (Ensure the admin consent workflow is enabled), CISA.MS.AAD.5.3 (An admin consent workflow SHALL be configured for applications.), EIDSCA.CR01 (Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.) check the same setting. Running both reports it twice.

Overview

Enabling the admin consent workflow in a Microsoft Entra tenant ensures that users who need access to an application that requires admin consent can submit a request for review rather than being blocked outright. Without the workflow, users who can’t consent to an app on their own may resort to shadow IT workarounds, such as using personal accounts or unsanctioned alternatives—that are harder to monitor and secure. When the workflow is enabled, consent requests go through a logged, auditable process where designated reviewers are notified and evaluate each request before consent is granted. This improves observability into which applications users are requesting access to, and ensures that elevated permissions are reviewed and explicitly approved rather than silently blocked or granted without oversight.

Remediation

For admin consent requests, set the Users can request admin consent to apps they are unable to consent to setting to Yes. Specify other settings, such as who can review requests.

• Enable the admin consent workflow
• Or use the Update adminConsentRequestPolicy API to set the isEnabled property to true and other settings

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Identity
Category	Application management
Product	Entra ID
Feature	App consent and permissions
Area	Applications and workload identities
ATT&CK	T1528 Steal Application Access Token
Licence	Free
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.