Skip to content
MitoMito Docs

CIS.M365.5.1.5.1: Ensure user consent to apps accessing company data on their behalf is not allowed
ID CIS.M365.5.1.5.1
Severity High
Suite CIS Microsoft 365 Foundations Benchmark
Product Entra ID
Feature App consent and permissions
Security area Applications and workload identities
Resource type Tenant
User impact of fixing Medium
Effort to fix Low
Benchmark CIS Microsoft 365 Foundations Benchmark 7.0.0, 5.1.5.1 (L2, E3 Level 2, E5 Level 2)
Framework controls cis-m365:5.1.5.1
nist-800-53-r5:AC-6(10) Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions
nist-800-53-r5:CM-5 Access Restrictions for Change
MITRE ATT&CK T1528, T1566.002
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

5.1.5.1 (L2) Ensure user consent to apps accessing company data on their behalf is not allowed

Control when end users and group owners are allowed to grant consent to applications, and when they will be required to request administrator review and approval. Allowing users to grant apps access to data helps them acquire useful applications and be productive but can represent a risk in some situations if it’s not monitored and controlled carefully.

Rationale

Section titled “Rationale”

Attackers commonly use custom applications to trick users into granting them access to company data. Restricting user consent mitigates this risk and helps to reduce the threat-surface.

Impact

Section titled “Impact”

If user consent is disabled, previous consent grants will still be honored but all future consent operations must be performed by an administrator. Tenant-wide admin consent can be requested by users through an integrated administrator consent request workflow or through organizational support processes

Remediation action

Section titled “Remediation action”
  1. Navigate to Microsoft 365 Entra admin center.
  2. Click to expand Entra ID and select Enterprise apps.
  3. Under Security select Consent and permissions > User consent settings.
  4. Under User consent for applications select Do not allow user consent.
  5. Click the Save option at the top of the window.
Section titled “Related links”

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: oed-metzb; contributors: Mynster9361. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.