CISA.MS.AAD.5.2 - Only administrators SHALL be allowed to consent to applications.

Contributed by Michael Soule with Merill FernandoAll contributors →

Overview

Only administrators SHALL be allowed to consent to applications.

Rationale: Limiting applications consent to only specific privileged users reduces risk of users giving insecure applications access to their data via consent grant attacks.

Remediation action

1. In Entra under Identity and Applications, select Enterprise applications.
2. Under Security, select Consent and permissions.
3. Under Manage, select User consent settings.
4. Under User consent for applications, select Do not allow user consent.
5. Click Save.

Related links

• Entra admin center - Consent and permissions | User consent settings
• CISA Application Registration & Consent - MS.AAD.5.2v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.5.2
Severity	High
Suite	CISA
Product	Entra ID
Feature	App consent and permissions
Area	Applications and workload identities
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1098.001 Additional Cloud Credentials, T1098.003 Additional Cloud Roles, T1528 Steal Application Access Token, T1566.002 Spearphishing Link
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.5.2
Criticality	SHALL
Upstream requirement	MS.AAD.5.2v1
Supports controls	cisa-scuba:MS.AAD.5.2, nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5
PowerShell test	Test-MtCisaAppUserConsent
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.5.2.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.5.2.md