CISA.MS.AAD.5.3 - An admin consent workflow SHALL be configured for applications.

Contributed by Michael SouleAll contributors →

Overview

An admin consent workflow SHALL be configured for applications.

Rationale: Configuring an admin consent workflow reduces the risk of the previous policy by setting up a process for users to securely request access to applications necessary for business purposes. Administrators have the opportunity to review the permissions requested by new applications and approve or deny access based on a risk assessment.

Remediation action:

1. In Entra create a new Group that contains admin users responsible for reviewing and adjudicating application consent requests. Group members will be notified when users request consent for new applications.
2. Then in Entra under Identity and Applications, select Enterprise applications.
3. Under Security, select Consent and permissions.
4. Under Manage, select Admin consent settings.
5. Under Admin consent requests and Users can request admin consent to apps they are unable to consent to select Yes.
6. Under Who can review admin consent requests, select + Add groups and select the group responsible for reviewing and adjudicating app requests (created in step one above).
7. Click Save.

Related links

• Entra admin center - Consent and permissions | Admin consent settings
• CISA Application Registration & Consent - MS.AAD.5.3v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.5.3
Severity	High
Suite	CISA
Product	Entra ID
Feature	App consent and permissions
Area	Applications and workload identities
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1098.001 Additional Cloud Credentials, T1098.003 Additional Cloud Roles, T1528 Steal Application Access Token
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.5.3
Criticality	SHALL
Upstream requirement	MS.AAD.5.3v1
Supports controls	cisa-scuba:MS.AAD.5.3, nist-800-53-r5:CM-4
PowerShell test	Test-MtCisaAppAdminConsent
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.5.3.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.5.3.md