Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'
Require administrators to provide consent for applications before use. The Powerpipe check ensures 'User consent for applications' is set to 'Do not allow user consent'. Prowler checks that the Entra authorization policy disallows user consent for applications.
Allowing end users to grant consent enables consent phishing and stealth access to mail, files, and directory data, impacting confidentiality and integrity. Attackers can obtain long-lived refresh tokens via offline_access, persist, and act as the user, evading detection.
What this control checks
Checks the user consent setting in the Microsoft Entra ID authorization policy
Audit evidence
Evidence that deployed resources meet this control: Prowler check entra_policy_restricts_user_consent_for_apps (prowler azure --checks entra_policy_restricts_user_consent_for_apps); PowerPipe control azure_compliance.control.ad_authorization_policy_user_consent_disallowed.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.5.15 (Access Control), A.5.16 (Identity Management), A.5.18 (Access Rights) and 1 more clause.
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.a (assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;), 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...), 11.3.2.c (individualise and restrict system administration privileges to the highest extent possible,) and 3 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.15 Access control
- A.5.16 Identity management
- A.5.18 Access rights
- A.8.2 Privileged access rights
- 2 Risk management policy
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 6.12 Ensure that 'User consent for applications' is set to 'Do not allow user consent'
- 5.12 Ensure that 'User consent for applications' is set to 'Do not allow user consent'
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- 1.11 Ensure `User consent for applications` is set to `Do not allow user consent`
- 1.10 Ensure `User consent for applications` is set to `Do not allow user consent`
- 2.12 Ensure `User consent for applications` is set to `Do not allow user consent`
- 164.308(a)(4)(i) Information access management
Related controls
- Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'
- Azure Management should require multifactor authentication
- Azure Service Management API should require multifactor authentication
- Custom RBAC roles should not be used
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_authorization_policy_user_consent_disallowed - Powerpipe Control:
azure_compliance.control.ad_authorization_policy_user_consent_disallowed - Prowler Check:
entra_policy_restricts_user_consent_for_apps
Last reviewed: 2026-10-09
Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'
Previous Page
Microsoft Entra ID policies should have 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' set to 'No'
Next Page