Resource-specific consent is restricted

Overview

If you let group owners consent to applications in Microsoft Entra ID, you create a lateral escalation path that bad actors can use to persist and steal data without admin credentials. If an attacker compromises a group owner account, they can register or use a malicious application and consent to high-privilege Graph API permissions scoped to the group. Attackers can potentially read all Teams messages, access SharePoint files, or manage group membership. This consent action creates a long-lived application identity with delegated or application permissions. The attacker maintains persistence with OAuth tokens, steals sensitive data from team channels and files, and impersonates users through messaging or email permissions. Without centralized enforcement of app consent policies, security teams lose visibility, and malicious applications spread under the radar, enabling multistage attacks across collaboration platforms.

Remediation

Set your organization’s Resource-Specific Consent (RSC) configuration to EnabledForPreApprovedAppsOnly and create preapproval policies for each app that requires RSC permissions. Don’t use the default ManagedByMicrosoft state.

• Enable RSC for a specific set of apps only

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Medium
Impact on users	Medium
Pillar	Identity
Category	Access control
Product	Entra ID
Feature	App consent and permissions
Area	Applications and workload identities
ATT&CK	T1528 Steal Application Access Token, T1566.002 Spearphishing Link
Licence	P1
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.