turbot/microsoft365_compliance

Control: 2.7 Ensure user consent to apps accessing company data on their behalf is not allowed

Description

Control when end users and group owners are allowed to grant consent to applications, and when they will be required to request administrator review and approval. Allowing users to grant apps access to data helps them acquire useful applications and be productive, but can represent a risk in some situations if it's not monitored and controlled carefully.

Attackers commonly use custom applications to trick users into granting them access to company data. Disabling future user consent operations setting mitigates this risk, and helps to reduce the threat-surface. If user consent is disabled, previous consent grants will still be honored but all future consent operations must be performed by an administrator.

Remediation

To prohibit user consent to apps accessing company data on their behalf

  1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
  2. Click to expand Azure Active Directory > Applications select Enterprise applications.
  3. Under Security select Consent and permissions.
  4. Under User consent for applications select Do not allow user consent.
  5. Click the Save option at the top of the window.

Default Value: UI - Allow user consent for apps.

Usage

Run the control in your terminal:

powerpipe control run microsoft365_compliance.control.cis_v200_2_7

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run microsoft365_compliance.control.cis_v200_2_7 --share

SQL

This control uses a named query:

azuread_authorization_policy_accessing_company_data_not_allowed

Tags