CIS.M365.5.1.5.2 - (L1) Ensure the admin consent workflow is enabled
Overview
5.1.5.2 (L1) Ensure the admin consent workflow is enabled
The admin consent workflow gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer takes action on the request, and the user is notified of the action.
Rationale
The admin consent workflow (Preview) gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer acts on the request, and the user is notified of the action.
Impact
To approve requests, a reviewer must be a Global Administrator, Cloud Application Administrator, or Application Administrator. The reviewer must already have one of these admin roles assigned; simply designating them as a reviewer doesn't elevate their privileges.
Remediation action
- Navigate to Microsoft Entra ID admin center.
- Under Entra ID select Enterprise apps
- Under Security select Consent and permissions
- Under Manage select Admin consent settings
- Set Users can request admin consent to apps they are unable to consent to to Yes
- Click Save.
Related links
- Microsoft Entra ID admin center
- Configure the admin consent workflow
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 242
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.1.5.2 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | App consent and permissions |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.5.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1, E5 Level 1 |
| Supports controls | cis-m365:5.1.5.2, nist-800-53-r5:CM-4 |
| PowerShell test | Test-MtCisAdminConsentWorkflowEnabled |
| Services | Graph |
Source
- Test:
tests/cis/Test.CIS.M365.5.1.5.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.1.5.2.md