EIDSCA.CP01: Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.

ID	EIDSCA.CP01
Severity	High
Suite	EIDSCA
Product	Entra ID
Feature	App consent and permissions
Security area	Applications and workload identities
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:AC-6(10) Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions nist-800-53-r5:CM-5 Access Restrictions for Change
MITRE ATT&CK	T1528, T1566.002
Reads from	Microsoft Graph

What this checks and how to fix it

Group and team owners can authorize applications, such as applications published by third-party vendors, to access your organization’s data associated with a group. For example, a team owner in Microsoft Teams can allow an app to read all Teams messages in the team, or list the basic profile of a group’s members.

CISA SCuBA 2.7: Non-Admin Users SHALL Be Prevented From Providing Consent To Third-Party Applications.

Test script

https://graph.microsoft.com/beta/settings
.values -eq 'False'

Related links

• Open in Graph Explorer
• directorySetting resource type - Microsoft Graph beta | Microsoft Learn
• View in Microsoft Entra admin center

MITRE ATT&CK

mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0001 - Initial Access - Initial Access
    (Mitigation)
      M1017 - User Training
      M1018 - User Account Management
      M1047 - Audit
    (Technique)
      T1566.002 - Phishing: Spearphishing Link
      T1078 - Valid Accounts

Tactic	Technique	Mitigation
TA0001 - Initial Access - Initial Access	T1566.002 - Phishing: Spearphishing Link T1078 - Valid Accounts	M1017 - User Training M1018 - User Account Management M1047 - Audit

---

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.