Entra app consent baseline: users, admins and credentials

Check the current user consent option at Enterprise apps > Consent and permissions > User consent settings. Learn says configuring user consent needs the Privileged Role Administrator role, and that Global Administrator is only required when you use the Entra admin center. Screenshot the setting for your change record.

If you plan to change settings through Graph PowerShell, Learn says you need the Policy.ReadWrite.Authorization scope (Policy.Read.All to read), signed in as Privileged Role Administrator. Learn also says to retrieve the current authorizationPolicy before updating, so you don’t remove permission grant policies that are assigned (developer consent, for example). Learn’s example for the low-impact policy shows differing policy strings between its PowerShell and Graph samples, so check the exact string against what your tenant returns rather than copying one.

Go to Enterprise apps > Consent and permissions > Admin consent settings. Learn says you must be a Global Administrator to turn the workflow on. Switch on Users can request admin consent to apps they are unable to consent to, add reviewers, and save. Learn says it can take up to an hour for the workflow to become enabled.

Check your reviewers. Learn says new reviewers can’t act on requests that existed or expired before they were added. Removed reviewers keep access to requests made while they were reviewers. Learn also points to the Update adminConsentRequestPolicy API in Microsoft Graph if you prefer to configure it that way.

Go to Enterprise apps > Consent and permissions > Permission classifications. Learn gives Cloud Application Administrator as the minimum role for the Graph PowerShell route, which needs the Policy.ReadWrite.PermissionGrant and Application.Read.All scopes.

Limits from Learn: only delegated permissions that don’t require admin consent can be classified. The Low classification is generally available. Medium and High are in preview. Microsoft’s own example classifies the basic sign-in set: openid, profile, email and offline_access. Start there and add by exception.

Back in User consent settings, choose the option from your decision above. For a restrictive setup, Learn recommends allowing user consent only for applications published by a verified publisher. Learn’s verified-publisher option also covers tenant-registered apps, and only for permissions you classify as low impact. If you disable user consent, Learn describes the Graph route as setting the default-user-role grant policies to only the managePermissionGrantsForOwnedResource.* entries via Update-MgPolicyAuthorizationPolicy. Check the exact values against the Learn page before running it.

Learn says changes to user consent settings only affect future consent operations. Existing grants remain until revoked. Also, apps that require user assignment need administrator consent even if a user consent policy would allow it.

For each enterprise app, use the review view described on Learn’s page for reviewing permissions granted to enterprise applications. Confirm where that view sits in your tenant, as the menu label may vary. Learn says you need Cloud Application Administrator or Application Administrator. The Admin consent tab shows organisation-wide permissions. The User consent tab shows permissions for a specific user or group.

Learn’s limits:

• You can revoke admin-consented permissions in the portal. You can’t revoke permissions in the User consent tab using the portal. Use Graph or PowerShell.
• Revoking a grant doesn’t stop users re-consenting. Block user consent, or stop the app requesting permissions dynamically.
• Learn links a separate page for restoring revoked or deleted permissions.

For Graph, Learn lists /servicePrincipals/{id}/oauth2PermissionGrants to review delegated grants and DELETE /oAuth2PermissionGrants/{id} to remove one. For application permissions it uses /servicePrincipals/{id}/appRoleAssignments, with removal through the appRoleAssignedTo path. Learn also warns that a consent review isn’t complete on its own, because Entra roles, Exchange RBAC and Teams RSC can also grant access.

Learn gives the portal path as Enterprise apps > All applications, select the app, then Security > Permissions > Grant admin consent. The alternative is App registrations > API permissions.

Roles, per Learn: Privileged Role Administrator for any permission on any API. Cloud Application Administrator, AI Administrator or Application Administrator for any API except Microsoft Graph app roles. A custom role with the grant-permissions permission also works.

Three things from Learn to hold in mind:

• Don’t grant consent if you don’t understand who controls the app and why it requests the permissions.
• Admin consent lets all users access the app by default. To restrict access, require user assignment.
• Granting tenant-wide consent may revoke permissions already granted tenant-wide for that app. Permissions granted programmatically have no review step and take effect immediately.

In the Entra admin center go to Entra ID > Overview > Recommendations and open Renew expiring application credentials (Graph type applicationCredentialExpiry). Learn documents signing in as at least Security Administrator. It flags credentials on an app registration that expire within the next 30 days.

Licensing is unclear. The recommendation’s Graph sample lists microsoftEntraWorkloadId as the required licence, but the Learn text only says some recommendations might need P2 or other licences. Check the recommendations overview and your tenant’s licences before you rely on it. The Graph endpoint shown is beta.

Learn’s rotation order: add the new credential, update the service, check the Key ID in the sign-in logs, then go back to App registrations > Certificates and Secrets and remove the old credential. For scripted rotation, Learn names the Graph methods addPassword, addKey, removePassword and removeKey.

Learn says client secret lifetime is limited to 24 months and a custom lifetime can’t exceed that. Microsoft recommends under 12 months.

Go to Enterprise apps > Application policies. Learn lists these portal settings: Block password addition, Restrict max password lifetime, Restrict max certificate lifetime, Block custom passwords and Block multitenant applications. For example, switch Block password addition to On, set Applies to to All applications, and save.

Facts from the Learn pages:

• The tenant default policy always exists and is disabled by default.
• An app that doesn’t meet a policy keeps working. Only the create or update operation that violates the policy is blocked, so existing secrets keep working.
• An app-level policy overrides the tenant default for the same restriction. Only one app management policy can be assigned per app.
• You can grant exceptions per app (All applications with exclusions, then Excluded apps) or per caller (Excluded callers). Caller exceptions use custom security attributes and need the Attribute Definition Administrator and Attribute Assignment Administrator roles as well.
• If policies were changed outside the admin center, the portal can disable editing until the restrictions are re-synchronised through Graph.
• The policy APIs on the configure page are Graph beta.

Roles: Microsoft’s pages disagree. The Graph overview says the least privileged roles are Application Administrator and Cloud Application Administrator. The configure page lists Security Administrator plus either of those, or Global Administrator alone. Use the stricter set unless you have tested the lighter one.

Learn recommends at least two owners per app, where possible, and using serviceManagementReference to hold team contact information. To add an owner: Enterprise apps > All applications, select the app, Owners > Add. The minimum role is Cloud Application Administrator or Application Administrator.

Use the admin centre for this. Learn says owners added through Graph or PowerShell can’t manage some enterprise app settings, such as attributes and claims, SAML certificate properties or token encryption. Also, if Restrict access to Microsoft Entra administration portal is set to Yes, non-admin owners can’t use the admin center to manage their apps. Groups can’t be owners.

For ownerless apps, Learn points to a Graph tutorial for listing ownerless applications (or those with a single owner). The portal can also filter enterprise apps by owner.

Learn says the best practice is a weekly review of consent grants. In the Defender portal, search the audit log for Consent to application activities and check whether IsAdminConsent is True. Learn says entries can take 30 minutes to 24 hours to appear.