# Admin consent workflow is enabled
Enabling the admin consent workflow in a Microsoft Entra tenant ensures that users who need access to an application that requires admin consent can…
Source: https://maester.dev/docs/tests/ZTA.21809
:::note[Maester checks this too]
[CIS.M365.5.1.5.2](/docs/tests/CIS.M365.5.1.5.2) (Ensure the admin consent workflow is enabled), [CISA.MS.AAD.5.3](/docs/tests/CISA.MS.AAD.5.3) (An admin consent workflow SHALL be configured for applications.), [EIDSCA.CR01](/docs/tests/EIDSCA.CR01) (Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.) check the same setting. Running both reports it twice.
:::
## Overview
Enabling the admin consent workflow in a Microsoft Entra tenant ensures that users who need access to an application that requires admin consent can submit a request for review rather than being blocked outright. Without the workflow, users who can't consent to an app on their own may resort to shadow IT workarounds, such as using personal accounts or unsanctioned alternatives—that are harder to monitor and secure. When the workflow is enabled, consent requests go through a logged, auditable process where designated reviewers are notified and evaluate each request before consent is granted. This improves observability into which applications users are requesting access to, and ensures that elevated permissions are reviewed and explicitly approved rather than silently blocked or granted without oversight.
## Remediation
For admin consent requests, set the **Users can request admin consent to apps they are unable to consent to** setting to **Yes**. Specify other settings, such as who can review requests.
- [Enable the admin consent workflow](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#enable-the-admin-consent-workflow)
- Or use the [Update adminConsentRequestPolicy](https://learn.microsoft.com/graph/api/adminconsentrequestpolicy-update?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) API to set the `isEnabled` property to true and other settings
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Identity |
| Category | Application management |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | App consent and permissions |
| Area | Applications and workload identities |
| ATT&CK | [T1528](/docs/tests?mitre=T1528) Steal Application Access Token |
| Licence | Free |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.