EIDSCA.CP01 - Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.
Overview
Group and team owners can authorize applications, such as applications published by third-party vendors, to access your organization's data associated with a group. For example, a team owner in Microsoft Teams can allow an app to read all Teams messages in the team, or list the basic profile of a group's members.
CISA SCuBA 2.7: Non-Admin Users SHALL Be Prevented From Providing Consent To Third-Party Applications.
Test script
https://graph.microsoft.com/beta/settings
.values -eq 'False'
Related links
- Open in Graph Explorer
- directorySetting resource type - Microsoft Graph beta | Microsoft Learn
- View in Microsoft Entra admin center
MITRE ATT&CK
| Tactic | Technique | Mitigation |
|---|---|---|
| TA0001 - Initial Access - Initial Access | T1566.002 - Phishing: Spearphishing Link T1078 - Valid Accounts | M1017 - User Training M1018 - User Account Management M1047 - Audit |
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.CP01 |
| Severity | High |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | App consent and permissions |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1566.002 Spearphishing Link |
| Supports controls | nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5 |
| PowerShell test | Test-MtCheckEidscaCP01 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.CP01.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.CP01.md