User consent settings
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit e58fd45 · +12 −6 lines · also on GitHub
11
---
22
title: Configure how users consent to applications
3
−description: Learn how to manage how and when users can consent to applications that request access to your organization's data.
43
4
+description: Configure user consent settings in Microsoft Entra ID to control when and how users grant permissions to your organization's data. Secure your environment with step‑by‑step guidance.
5
+
56
author: omondiatieno
67
manager: CelesteDG
78
ms.service: entra-id
89
ms.subservice: enterprise-apps
910
1011
ms.topic: how-to
11
−ms.date: 09/16/2024
12
+ms.date: 04/30/2025
1213
ms.author: jomondi
1314
ms.reviewer: phsignor, ergreenl
1415
ms.custom: enterprise-apps
⋯ 5 unchanged lines
2021
2122
# Configure how users consent to applications
2223
23
−In this article, you'll learn how to configure the way users consent to applications and how to disable all future user consent operations to applications.
24
+In this article, you learn how to configure user consent settings in Microsoft Entra ID to control when and how users grant permissions to applications. This guidance helps IT admins reduce security risks by restricting or disabling user consent.
2425
2526
Before an application can access your organization's data, a user must grant the application permissions to do so. Different permissions allow different levels of access. By default, all users are allowed to consent to applications for permissions that don't require administrator consent. For example, by default, a user can consent to allow an app to access their mailbox but can't consent to allow an app unfettered access to read and write to all files in your organization.
2627
2728
To reduce the risk of malicious applications attempting to trick users into granting them access to your organization's data, we recommend that you allow user consent only for applications that have been published by a [verified publisher](~/identity-platform/publisher-verification-overview.md).
2829
2930
> [!NOTE]
30
−> Applications that requires users to be assigned to the application must have their permissions consented by an administrator, even if the user consent policies for your directory would otherwise allow a user to consent on behalf of themselves.
31
+> Applications that require users to be assigned to the application must have their permissions consented by an administrator, even if the user consent policies for your directory would otherwise allow a user to consent on behalf of themselves.
3132
3233
## Prerequisites
3334
⋯ 4 unchanged lines
3839
3940
## Configure user consent settings
4041
42
+You can configure user consent settings in Microsoft Entra ID using either the Microsoft Entra admin center, Microsoft Graph PowerShell, or Microsoft Graph API. The settings you configure apply to all users in your organization.
43
+
4144
:::zone pivot="portal"
4245
46
+### Configure user consent in Microsoft Entra admin center
4347
4448
To configure user consent settings through the Microsoft Entra admin center:
4549
⋯ 11 unchanged lines
5761
5862
:::zone pivot="ms-powershell"
5963
60
−To choose which app consent policy governs user consent for applications, you can use the [Microsoft Graph PowerShell](/powershell/microsoftgraph/get-started?view=graph-powershell-1.0&preserve-view=true) module. The cmdlets used here are included in the [Microsoft.Graph.Identity.SignIns](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.SignIns) module.
64
+To choose which app consent policy governs user consent for applications, use the [Microsoft Graph PowerShell](/powershell/microsoftgraph/get-started?view=graph-powershell-1.0&preserve-view=true) module. The cmdlets used here are included in the [Microsoft.Graph.Identity.SignIns](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.SignIns) module.
6165
6266
### Connect to Microsoft Graph PowerShell
6367
⋯ 3 unchanged lines
6771
Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"
6872
```
6973
70
−### Disable user consent
74
+### Disable user consent using Microsoft Graph PowerShell
7175
7276
To disable user consent, ensure that the consent policies (`PermissionGrantPoliciesAssigned`) include other current `ManagePermissionGrantsForOwnedResource.*` policies if any while updating the collection. This way, you can maintain your current configuration for user consent settings and other resource consent settings.
7377
⋯ 45 unchanged lines
119123
:::zone pivot="ms-graph"
120124
121125
Use the [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) to choose which app consent policy governs user consent for applications. You need to sign in as a [Privileged Role Administrator](~/identity/role-based-access-control/permissions-reference.md#privileged-role-administrator).
126
+
127
+### Disable user consent using Microsoft Graph
122128
123129
To disable user consent, ensure that the consent policies (`PermissionGrantPoliciesAssigned`) include other current `ManagePermissionGrantsForOwnedResource.*` policies if any while updating the collection. This way, you can maintain your current configuration for user consent settings and other resource consent settings.
124130
⋯ 57 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:44 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.