How to Audit Application Consent Grants in Microsoft Entra ID

In an illicit consent grant attack, threat actors register a malicious application to request access to sensitive organizational data. Mostly they trick users through phishing attempts or compromised websites to grant consent to that malicious app. This allows that app to access the organization's data without needing further authentication.

Investigate app consent grants to spot unverified access

As password resets and MFA can’t prevent this type of attack, it’s important to review app consent grants to detect and stop unauthorized access.

Connect-MgGraph -Scopes "Application.Read.All", "DelegatedPermissionGrant.Read.All" 
Get-MgServicePrincipal -Filter "DisplayName eq '<AppDisplayName>'" | ForEach-Object 
{ Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $_.Id } | Format-Table -Wrap -AutoSize

Note: Before executing the cmdlet above, replace <AppDisplayName> with the display name of the application for which you want to check consent grants.

Here, check the ConsentType to determine whether the permissions are admin consented, or user consented. The consent type ‘AllPrincipals’ indicates admin consent, while ‘Principal’ indicates user consent.

Handy Tip: After finding app consented with any high-privileged or unnecessary permissions, use the same consent grant audit report to see when the app had access. This will help you assess the full extent of the attack.

Revoke app permissions in Microsoft Entra to prevent unauthorized access

If you confirmed the attack, you could follow the steps below to remediate illicit consent grant attacks.

Further Consideration: Block sign-in for the affected user account to restrict app access, and disable user consent to mandate the admin approval for granting app access.

Some applications used by employees may require permissions that only an admin can approve. When user consent is disabled or the app requests high-privilege access, users are blocked from proceeding. In such cases, the admin consent workflow gives users a way to request access without bypassing admin control. This ensures security without disrupting productivity in your organization.

Pre-requisite: You must be a Global Administrator to configure the admin consent workflow for apps in Entra ID.

Create admin consent workflow for apps in Microsoft Entra ID

To activate admin consent workflow and assign reviewers, follow the steps below.

Note: The maximum duration you can set is 60 days. Also, it may take up to an hour for the workflow to be fully enabled.

Controlling when and how users grant app permissions is key to reducing unnecessary access and securing organizational data. By default, users can approve applications that request for selected permission not requiring admin approval. While this may seem harmless, attackers often exploit it using deceptive apps to gain access.

To mitigate this risk, you can follow the steps below to manage user app consent settings in Entra ID.

Configure how user consent to applications in Microsoft Entra admin center

• Do not allow user consent – Users are prevented from consenting to any app and only admins can approve access.
• Allow user consent for apps from verified publishers, for selected permissions (Recommended) – Users are allowed to consent to "low impact" permissions for apps from verified publishers or apps registered in the organization.
• Allow user consent for all apps – Grants users the ability to consent to any app requesting permissions.

Note: If you chose the consent for apps from verified publishers policy, define the desired low-impact permissions for your organization by using either the Select permissions to classify as low impact option or the Permission classifications section.

Configure user consent settings for Entra apps using PowerShell

You can also use PowerShell to set app consent policies that define how users can grant access to applications. To do so, first connect to Microsoft Graph with required permissions using the cmdlet below.

Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"

Run the following cmdlet to enable user consent subject to the built-in policy ‘microsoft-user-default-low’ (Allow user consent for apps from verified publishers, for selected permissions).

$body = @{ 
defaultUserRolePermissions = @{ 
permissionGrantPoliciesAssigned = @( 
"managePermissionGrantsForSelf.microsoft-user-default-low") 
}} 
Update-MgPolicyAuthorizationPolicy -BodyParameter $body

You can also set other two policies such as microsoft-user-default-recommended (Do not allow user consent) and microsoft-user-default-legacy (Allow user consent for all apps) using these policy ids.

Important: Even if you disable user consent to apps, users can still consent to apps accessing the groups they own.

Microsoft Entra ID app consent policies give you control over your organization's data access by establishing clear guidelines for application approval. These policies operate through a straightforward but powerful system of 'include' and 'exclude' condition sets, where applications must match at least one include condition while avoiding all exclude conditions to receive approval.

To manage app consent policies for applications, you need to connect with Microsoft Graph PowerShell with following cmdlet.

Connect-MgGraph -Scopes "Policy.ReadWrite.PermissionGrant"

View existing app consent policies using PowerShell

Create custom app consent policy in Microsoft 365

To remove a custom app consent policy, use the Remove-MgPolicyPermissionGrantPolicy cmdlet like below.

Remove-MgPolicyPermissionGrantPolicy -PermissionGrantPolicyId "<Policy-Id>"

Note: Replace the placeholders in the cmdlets with your actual values, such as policy IDs, display names, and more before execution.