CISA.MS.AAD.5.4: Group owners SHALL NOT be allowed to consent to applications.

Deprecated

This check is deprecated and will be removed in a future version.

ID	CISA.MS.AAD.5.4
Severity	High
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	App consent and permissions
Security area	Applications and workload identities
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.5.4 (SHALL)
Framework controls	cisa-scuba:MS.AAD.5.4
MITRE ATT&CK	T1528, T1566.002
Reads from	Microsoft Graph
Lifecycle	Deprecated

What this checks and how to fix it

This test is deprecated by CISA as of March 2025 and will always be skipped. The content below is retained as a historical archive and will be removed in a future version.

MS.AAD.5.4v1 was removed because Microsoft announced via MC712143 that group owner consent to applications is no longer a configurable setting. The setting has been removed from the product entirely, making the policy moot. See CISA SCuBA Removed Policies — MS.AAD.5.4v1.

Group owners SHALL NOT be allowed to consent to applications.

Rationale: In M365, group owners and team owners can consent to applications accessing data in the tenant. By requiring consent requests to go through an approval workflow, risk of exposure to malicious applications is reduced.

Remediation action:

1. In Entra under Identity and Applications, select Enterprise applications.
2. Under Security, select Consent and permissions.
3. Under Manage, select User consent settings.
4. Under Group owner consent for apps accessing data, select Do not allow group owner consent.
5. Click Save.

Related links

• Entra admin center - Consent and permissions | User consent settings
• CISA Application Registration & Consent - MS.AAD.5.4v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: michaelmsonne, weyCC81, SamErde. Open-source licences.