Skip to content
MitoMito Docs

EIDSCA.CP03: Default Settings - Consent Policy Settings - Block user consent for risky apps.
ID EIDSCA.CP03
Severity High
Suite EIDSCA
Product Entra ID
Feature App consent and permissions
Security area Applications and workload identities
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:AC-6(10) Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions
nist-800-53-r5:CM-5 Access Restrictions for Change
MITRE ATT&CK T1528, T1566.002
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Defines whether user consent will be blocked when a risky request is detected

Configure risk-based step-up consent - Microsoft Entra ID - Microsoft Learn

Test script

Section titled “Test script”
https://graph.microsoft.com/beta/settings
.values -eq 'true'
Section titled “Related links”

MITRE ATT&CK

Section titled “MITRE ATT&CK”
mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0001 - Initial Access - Initial Access
    (Mitigation)
      M1017 - User Training
      M1018 - User Account Management
      M1047 - Audit
    (Technique)
      T1566.002 - Phishing: Spearphishing Link
      T1078 - Valid Accounts
Tactic Technique Mitigation
TA0001 - Initial Access - Initial Access T1566.002 - Phishing: Spearphishing Link
T1078 - Valid Accounts		 M1017 - User Training
M1018 - User Account Management
M1047 - Audit

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.