Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'
Require administrators to provide consent for applications before use. The Powerpipe check ensures 'User consent for applications' is set to 'Do not allow user consent'. Prowler checks that the Entra authorization policy disallows user consent for applications.
What this control checks
Checks the user consent setting in the Microsoft Entra ID authorization policy
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.15 Access control
- A.5.16 Identity management
- A.5.18 Access rights
- A.8.2 Privileged access rights
- 2 Risk management policy
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 6.12 Ensure that 'User consent for applications' is set to 'Do not allow user consent'
- 5.12 Ensure that 'User consent for applications' is set to 'Do not allow user consent'
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- 1.11 Ensure `User consent for applications` is set to `Do not allow user consent`
- 1.10 Ensure `User consent for applications` is set to `Do not allow user consent`
- 2.12 Ensure `User consent for applications` is set to `Do not allow user consent`
- 164.308(a)(4)(i) Information access management
Related controls
- Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'
- Azure Management should require multifactor authentication
- Azure Service Management API should require multifactor authentication
- Custom RBAC roles should not be used
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_authorization_policy_user_consent_disallowed - Powerpipe Control:
azure_compliance.control.ad_authorization_policy_user_consent_disallowed - Prowler Check:
entra_policy_restricts_user_consent_for_apps
Last reviewed: 2026-10-09
Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'
Previous Page
Microsoft Entra ID policies should have 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' set to 'No'
Next Page