Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'
Evaluates the Microsoft Entra ID policy for `User consent for applications` against the expected value `Allow user consent for apps from verified publishers, for selected permissions`, which limits user consent to verified publishers and selected permissions.
What this control checks
User consent is limited to verified publishers and selected permissions
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.15 Access control
- A.5.18 Access rights
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 6.13 Ensure that 'User consent for applications' is set to 'Allow user consent for apps from verified publishers, for selected permissions'
- 5.13 Ensure that 'User consent for applications' is set to 'Allow user consent for apps from verified publishers, for selected permissions'
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- 1.12 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'
- 1.11 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'
- 2.13 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers'
- 164.308(a)(4)(i) Information access management
Related controls
- Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'
- Azure subscriptions should restrict use of the 'User Access Administrator' role
- SQL servers should have an Azure Active Directory administrator configured
- Service Bus namespaces should have Azure Active Directory (Azure AD) authentication configured
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_authorization_policy_user_consent_verified_publishers_selected_permissions - Powerpipe Control:
azure_compliance.control.ad_authorization_policy_user_consent_verified_publishers_selected_permissions - Prowler Check:
entra_policy_user_consent_for_verified_apps
Last reviewed: 2026-10-09