Detections
Analytics

5.1.5.2 Ensure the admin consent workflow is enabled

Information

The admin consent workflow gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer takes action on the request, and the user is notified of the action.

The admin consent workflow (Preview) gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer acts on the request, and the user is notified of the action.

Solution

To remediate using the UI:

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
 - Expand Entra ID and select Enterprise apps.
 - Under Security select Consent and permissions.
 - Under Manage select Admin consent settings.
 - Set Users can request admin consent to apps they are unable to consent to to Yes under Admin consent requests.
 - Under the Reviewers choose the Roles and Groups that will review user generated app consent requests.
 - Set Selected users will receive email notifications for requests to Yes
 - Select Save at the top of the window.

Impact:

To approve requests, a reviewer must be a global administrator, cloud application administrator, or application administrator. The reviewer must already have one of these admin roles assigned; simply designating them as a reviewer doesn't elevate their privileges.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-1, 800-53|AC-2, 800-53|CM-7(5), 800-53|CM-10, 800-53|IA-4, 800-53|IA-5, CSCv7|18.3

Plugin: microsoft_azure

Control ID: b2771d08bb489bda9bf50d4746aed5f09678becb51504066703b5ee08f2e8c9e