User consent settings
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5f13a7a · +20 −1 lines · also on GitHub
⋯ 35 unchanged lines
3636
3737
- A user account. If you don't already have one, you can [create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
3838
- A [Privileged Role Administrator](~/identity/role-based-access-control/permissions-reference.md#privileged-role-administrator) role.
39
+- A [Global Administrator](~/identity/role-based-access-control/permissions-reference.md#global-administrator) role is only required when using the Microsoft Entra admin center.
3940
4041
## Configure user consent settings
4142
⋯ 5 unchanged lines
4748
4849
To configure user consent settings through the Microsoft Entra admin center:
4950
50
−1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Privileged Role Administrator](~/identity/role-based-access-control/permissions-reference.md#privileged-role-administrator).
51
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](~/identity/role-based-access-control/permissions-reference.md#global-administrator).
5152
5253
1. Browse to **Entra ID** > **Enterprise apps** > **Consent and permissions** > **User consent settings**.
5354
⋯ 7 unchanged lines
6162
6263
:::zone pivot="ms-powershell"
6364
65
+## Understand authorization and permission grant policies in Microsoft Graph PowerShell
66
+
67
+To configure user consent settings programmatically using Microsoft Graph PowerShell, it's important to understand the distinction between the tenant-wide **authorization policy** and individual **permission grant policies**. The `authorizationPolicy`, retrieved using [Update-MgPolicyAuthorizationPolicy](https://learn.microsoft.com/powershell/module/microsoft.graph.identity.signins/update-mgpolicyauthorizationpolicy?view=graph-powershell-1.0) governs global settings such as whether users can consent to apps and which permission grant policies are assigned to the default user role. For example, you can disable user consent while still allowing developers to manage permissions for the apps they own by assigning only `ManagePermissionGrantsForOwnedResource.DeveloperConsent` in the `permissionGrantPoliciesAssigned` collection.
68
+
69
+On the other hand, the [permissionGrantPolicies](https://learn.microsoft.com/powershell/module/microsoft.graph.identity.signins/get-mgpolicypermissiongrantpolicy?view=graph-powershell-1.0) endpoint, lists all defined consent policies in the tenant. These policies determine the specific types of app permissions that users are allowed to grant—such as low-risk delegated permissions. For instance, a policy like `UserConsentLowRisk` might allow users to consent only to apps that request basic profile information, while a custom policy could restrict consent even further or broaden it for specific user groups.
70
+
71
+> [!NOTE]
72
+> Before updating consent settings with a `Update-MgPolicyPermissionGrantPolicy` command, always retrieve the current `authorizationPolicy` to identify which permission grant policies are already assigned. This ensures you preserve necessary permissions—such as those enabling developers to manage consent for apps they own—and avoid unintentionally removing existing functionality.
73
+
6474
To choose which app consent policy governs user consent for applications, use the [Microsoft Graph PowerShell](/powershell/microsoftgraph/get-started?view=graph-powershell-1.0&preserve-view=true) module. The cmdlets used here are included in the [Microsoft.Graph.Identity.SignIns](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.SignIns) module.
6575
6676
Connect to Microsoft Graph PowerShell using the least-privilege permission needed. For reading the current user consent settings, use *Policy.Read.All*. For reading and changing the user consent settings, use *Policy.ReadWrite.Authorization*. You need to sign in as a [Privileged Role Administrator](~/identity/role-based-access-control/permissions-reference.md#privileged-role-administrator).
⋯ 52 unchanged lines
119129
:::zone-end
120130
121131
:::zone pivot="ms-graph"
132
+
133
+## Understand authorization and permission grant policies in Microsoft Graph
134
+
135
+To configure user consent settings programmatically using Microsoft Graph, it's important to understand the distinction between the tenant-wide **authorization policy** and individual **permission grant policies**. The `authorizationPolicy` (retrieved using `GET https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy`) governs global settings such as whether users can consent to apps and which permission grant policies are assigned to the default user role. For example, you can disable user consent while still allowing developers to manage permissions for the apps they own by assigning only `ManagePermissionGrantsForOwnedResource.DeveloperConsent` in the `permissionGrantPoliciesAssigned` collection.
136
+
137
+On the other hand, the `permissionGrantPolicies` endpoint (`GET https://graph.microsoft.com/v1.0/policies/permissionGrantPolicies`) lists all defined consent policies in the tenant. These policies determine the specific types of app permissions that users are allowed to grant—such as low-risk delegated permissions. For instance, a policy like `UserConsentLowRisk` might allow users to consent only to apps that request basic profile information, while a custom policy could restrict consent even further or broaden it for specific user groups.
138
+
139
+> [!NOTE]
140
+> Before updating consent settings with a `PATCH` request, always retrieve the current `authorizationPolicy` to identify which permission grant policies are already assigned. This ensures you preserve necessary permissions—such as those enabling developers to manage consent for apps they own—and avoid unintentionally removing existing functionality.
122141
123142
Use the [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) to choose which app consent policy governs user consent for applications. You need to sign in as a [Privileged Role Administrator](~/identity/role-based-access-control/permissions-reference.md#privileged-role-administrator).
124143
⋯ 61 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:44 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.