EIDSCA.CP03 - Default Settings - Consent Policy Settings - Block user consent for risky apps.

Contributed by Thomas NaunheimAll contributors →

Overview

Defines whether user consent will be blocked when a risky request is detected

Configure risk-based step-up consent - Microsoft Entra ID - Microsoft Learn

Test script

https://graph.microsoft.com/beta/settings
.values -eq 'true'

Related links

• Open in Graph Explorer
• directorySetting resource type - Microsoft Graph beta | Microsoft Learn

MITRE ATT&CK

Tactic	Technique	Mitigation
TA0001 - Initial Access - Initial Access	T1566.002 - Phishing: Spearphishing Link T1078 - Valid Accounts	M1017 - User Training M1018 - User Account Management M1047 - Audit

Test Metadata

Field	Value
Test ID	EIDSCA.CP03
Severity	High
Suite	Entra ID SCA
Product	Entra ID
Feature	App consent and permissions
Area	Applications and workload identities
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1528 Steal Application Access Token, T1566.002 Spearphishing Link
Supports controls	nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5
PowerShell test	Test-MtCheckEidscaCP03
Services	Graph

Source

• Test: tests/eidsca/Test.EIDSCA.CP03.ps1
• Documentation: tests/eidsca/Test.EIDSCA.CP03.md