Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'
Evaluates the Microsoft Entra ID policy for `User consent for applications` against the expected value `Allow user consent for apps from verified publishers, for selected permissions`, which limits user consent to verified publishers and selected permissions.
Broad self-consent enables OAuth consent phishing and rogue apps to gain tokens to tenant data (confidentiality), request write scopes to change resources (integrity), and persist via refresh tokens after password changes. Mis-scoped grants can drive lateral movement and privilege escalation.
What this control checks
User consent is limited to verified publishers and selected permissions
Common pitfalls
Presence of legacy policy means self-consent
Its presence means users can self-consent to app permissions; its absence indicates consent is restricted (e.g., only verified publishers or low-impact scopes).
Audit evidence
Evidence that deployed resources meet this control: Prowler check entra_policy_user_consent_for_verified_apps (prowler azure --checks entra_policy_user_consent_for_verified_apps); PowerPipe control azure_compliance.control.ad_authorization_policy_user_consent_verified_publishers_selected_permissions.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.5.15 (Access Control) and A.5.18 (Access Rights).
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.a (assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;), 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...), 11.3.2.c (individualise and restrict system administration privileges to the highest extent possible,) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.15 Access control
- A.5.18 Access rights
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 6.13 Ensure that 'User consent for applications' is set to 'Allow user consent for apps from verified publishers, for selected permissions'
- 5.13 Ensure that 'User consent for applications' is set to 'Allow user consent for apps from verified publishers, for selected permissions'
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- 1.12 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'
- 1.11 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'
- 2.13 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'
- 164.308(a)(4)(i) Information access management
Related controls
- Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'
- Azure subscriptions should restrict use of the 'User Access Administrator' role
- SQL servers should have an Azure Active Directory administrator configured
- Service Bus namespaces should have Azure Active Directory (Azure AD) authentication configured
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_authorization_policy_user_consent_verified_publishers_selected_permissions - Powerpipe Control:
azure_compliance.control.ad_authorization_policy_user_consent_verified_publishers_selected_permissions - Prowler Check:
entra_policy_user_consent_for_verified_apps
Last reviewed: 2026-10-09