Lock down app consent without blocking your users

When a user signs in to a third-party app for the first time, the app can ask for permissions to their data, such as reading their mail or files. If users can grant any permission, an attacker only needs a convincing app and a phishing email. The resulting access survives password resets, because it isn't based on the password.

1. Restrict user consent

In the Entra admin center, go to Enterprise applications → Consent and permissions → User consent settings. Choose:

• Allow user consent for apps from verified publishers, for selected permissions, and
• under Permission classifications, mark only low-risk permissions (such as User.Read, openid, profile, email and offline_access) as low impact.

Users can still sign in to well-known apps that only need basic profile access. Anything riskier needs an admin.

2. Turn on the admin consent workflow

Under Enterprise applications → Admin consent settings, enable Users can request admin consent to apps they are unable to consent to, and choose reviewers. Instead of a dead end, users see a request form, and reviewers get an email with the app and the permissions requested.

3. Review what's already granted

Existing consents aren't affected by the new settings. Review the apps with risky delegated permissions such as Mail.Read, Files.ReadWrite.All or anything granted to all users:

Connect-MgGraph -Scopes "Directory.Read.All"

Get-MgOauth2PermissionGrant -All |
  Where-Object { $_.Scope -match "Mail\.|Files\.|Sites\.|Directory\." } |
  ForEach-Object {
    [pscustomobject]@{
      App         = (Get-MgServicePrincipal -ServicePrincipalId $_.ClientId).DisplayName
      ConsentType = $_.ConsentType
      Scope       = $_.Scope
    }
  } | Sort-Object App | Format-Table -AutoSize

Revoke anything you don't recognise, and investigate how it got there.

What reviewers should check

• Is the publisher verified, and is it the company you expect?
• Do the requested permissions match what the app does?
• Is this a delegated or application permission?
• Who in the business owns the request, and is there a contract?
• Is there a narrower permission available?

The Graph permission explainer shows what each permission allows and suggests narrower alternatives.

If you find a malicious grant

1. Remove the app's permissions and disable sign-in for the Enterprise App.
2. Revoke the affected users' sessions.
3. Check the audit log for when consent was granted and by whom.
4. Check what the app accessed, using the mailbox and SharePoint audit logs.