CIS.M365.5.1.5.1 - (L2) Ensure user consent to apps accessing company data on their behalf is not allowed
Overview
5.1.5.1 (L2) Ensure user consent to apps accessing company data on their behalf is not allowed
Control when end users and group owners are allowed to grant consent to applications, and when they will be required to request administrator review and approval. Allowing users to grant apps access to data helps them acquire useful applications and be productive but can represent a risk in some situations if it's not monitored and controlled carefully.
Rationale
Attackers commonly use custom applications to trick users into granting them access to company data. Restricting user consent mitigates this risk and helps to reduce the threat-surface.
Impact
If user consent is disabled, previous consent grants will still be honored but all future consent operations must be performed by an administrator. Tenant-wide admin consent can be requested by users through an integrated administrator consent request workflow or through organizational support processes
Remediation action
- Navigate to Microsoft 365 Entra admin center.
- Click to expand Entra ID and select Enterprise apps.
- Under Security select Consent and permissions > User consent settings.
- Under User consent for applications select Do not allow user consent.
- Click the Save option at the top of the window.
Related links
- Microsoft 365 Entra admin center
- Configure how users consent to applications
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 239
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.1.5.1 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | App consent and permissions |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1566.002 Spearphishing Link |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.5.1 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2, E5 Level 2 |
| Supports controls | cis-m365:5.1.5.1, nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5 |
| PowerShell test | Test-MtCisEnsureUserConsentToAppsDisallowed |
| Services | Graph |
Source
- Test:
tests/cis/Test.CIS.M365.5.1.5.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.1.5.1.md