EIDSCA.CP04: Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.

ID	EIDSCA.CP04
Severity	High
Suite	EIDSCA
Product	Entra ID
Feature	App consent and permissions
Security area	Applications and workload identities
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:CM-4 Impact Analyses
MITRE ATT&CK	T1528, T1566.002
Reads from	Microsoft Graph

What this checks and how to fix it

If this option is set to enabled, then users request admin consent to any app that requires access to data they do not have the permission to grant. If this option is set to disabled, then users must contact their admin to request to consent in order to use the apps they need.

CISA SCuBA 2.7: Non-Admin Users SHALL Be Prevented From Providing Consent To Third-Party Applications.

Test script

https://graph.microsoft.com/beta/settings
.values -eq 'true'

Related links

• Open in Graph Explorer
• directorySetting resource type - Microsoft Graph beta | Microsoft Learn
• View in Microsoft Entra admin center

MITRE ATT&CK

mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0001 - Initial Access - Initial Access
    (Mitigation)
      M1017 - User Training
      M1018 - User Account Management
      M1047 - Audit
    (Technique)
      T1566.002 - Phishing: Spearphishing Link
      T1078 - Valid Accounts

Tactic	Technique	Mitigation
TA0001 - Initial Access - Initial Access	T1566.002 - Phishing: Spearphishing Link T1078 - Valid Accounts	M1017 - User Training M1018 - User Account Management M1047 - Audit

---

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.