App consent in Microsoft Entra ID and consent phishing, explained

When someone selects “Accept” on a screen asking whether an app may read their mail, files or profile, they are granting consent. Many apps that ask for consent are legitimate, such as calendar tools and add-ins. Microsoft’s documentation explains how the same mechanism can be misused, and describes user consent settings in Microsoft Entra ID that limit who can grant consent. This page covers consent phishing, the default behaviour, the user consent settings and admin consent workflow, and what Microsoft describes if a malicious app is found.

What consent phishing is

Microsoft describes consent phishing like this: attacks “trick users into granting permissions to malicious cloud applications”, which can then gain access to legitimate cloud services and users’ data. Microsoft contrasts this with credential compromise. Instead of stealing a password, the attacker targets users who can grant access to data directly. Microsoft notes that the consent screen shows every permission the application receives, and that because a legitimate provider (such as the Microsoft identity platform) hosts the application, unsuspecting users accept.

Microsoft’s guide to responding to a compromised email account includes reviewing the list of applications with user consent, and removing and revoking any that shouldn’t be allowed. Phishing, smishing and vishing explained covers the wider family of scams that impersonate trusted people or organisations.

How user consent works by default

Microsoft’s documentation states that, by default, “all users are allowed to consent to applications for permissions that don’t require administrator consent”. Microsoft gives an example: by default, a user can consent to an app accessing their own mailbox, but can’t consent to an app having unrestricted read and write access to all files in the organisation.

The settings Microsoft’s documentation describes

User consent settings

Microsoft’s user consent documentation describes these approaches:

The two built-in policy names above are the ones Microsoft’s page quotes. In the Microsoft Entra admin center, Microsoft’s page says the choice is made under User consent for applications; the exact wording of the options on that screen can change, so Microsoft’s page is the reference for current labels.

To reduce the risk of malicious applications tricking users into granting access to an organisation’s data, Microsoft’s documentation recommends allowing user consent only for applications “that have been published by a verified publisher”. Microsoft’s consent-phishing page also describes configuring user consent so that users can consent only to applications developed by the organisation or from verified publishers, and only for low-risk permissions the organisation selects.

Where the user consent setting lives

Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s user consent guide has the latest steps.

1. Sign in to the Microsoft Entra admin center as a Global Administrator. (Microsoft’s page says the Privileged Role Administrator role is enough for the Graph and PowerShell methods; Global Administrator is only required when using the admin center.)
2. Go to Enterprise apps > Consent and permissions > User consent settings. (Microsoft’s page currently starts this path at Identity > Applications; its admin consent page starts at Entra ID.)
3. Under User consent for applications, choose the consent setting for all users.
4. Select Save.

Admin consent workflow

Microsoft describes the admin consent workflow as a way for users who can’t consent to an app to send a request for admin approval. The request goes by email to designated reviewers, and the user is notified of the outcome. Microsoft notes that designating someone as a reviewer doesn’t raise their privileges, and that turning on the workflow requires a Global Administrator. Microsoft 365 admin roles and least privilege explains the Global Administrator role and how Microsoft describes limiting it.

Based on Microsoft’s instructions (checked October 2026). Microsoft’s admin consent workflow guide has the latest steps.

1. Sign in to the Microsoft Entra admin center as a Global Administrator.
2. Go to Entra ID > Enterprise apps > Consent and permissions > Admin consent settings.
3. Under Admin consent requests, select Yes for Users can request admin consent to apps they are unable to consent to.
4. Choose Who can review admin consent requests, and set the email notification, reminder and Consent request expires after (days) options.
5. Select Save. Microsoft says it can take up to an hour for the workflow to become enabled.

Existing consents

Microsoft states that updates to user consent settings “only affect future consent operations”. Existing consent grants remain, and users keep the access previously granted. Microsoft’s consent-phishing page describes routinely auditing applications and consented permissions so that applications access only the data they need, in line with least privilege.

Based on Microsoft’s instructions (checked October 2026). Microsoft’s guide to reviewing app permissions has the latest steps.

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
2. Go to Entra ID > Enterprise apps > All applications and select the app.
3. Select Permissions. The Admin consent tab shows permissions granted for the whole organisation; the User consent tab shows permissions granted by individual users or groups.
4. Select a permission to open its details.

Microsoft’s page says admin-consented permissions can be revoked from the Admin consent tab (select … > Revoke permission), but user-consented permissions can’t be revoked in the portal; Microsoft describes Microsoft Graph or PowerShell for those.

Points Microsoft’s consent-phishing guidance raises

• Names and domains aren’t proof. Microsoft says not to rely on application names and domain URLs as a source of authenticity.
• Verified publishers. Microsoft explains that publisher verification helps administrators and users understand the authenticity of application developers through a Microsoft-supported vetting process. It adds that, even when an app has a verified publisher, it’s still important to review the consent prompt.
• Education. Microsoft describes educating the organisation on how its permissions and consent framework works, and making sure administrators know how to evaluate consent requests.
• Microsoft’s own action. Microsoft says that when it confirms an application violates its terms of service, Microsoft Entra ID disables it across Microsoft services. New and refresh token requests are denied, but existing access tokens remain valid until they expire.

What Microsoft’s guidance describes if a malicious app is found

Microsoft’s consent-phishing page describes:

1. investigating the application’s activity, including the delegated or application permissions it requested
2. reviewing Microsoft Entra audit logs for activity by the application, and sign-in activity for users who authorised it (what Entra sign-in logs record)
3. following Microsoft’s guidance on defending against illicit consent grants, including auditing permissions and consent.

Where a user’s account may also be compromised, the compromised Microsoft 365 account checklist sets out Microsoft’s response steps.

Common questions

How do I stop users consenting to apps in Microsoft 365?

The user consent setting in Microsoft Entra ID controls this. Microsoft’s instructions place it under Enterprise apps > Consent and permissions > User consent settings, where the choice is made under User consent for applications. Microsoft’s documentation recommends allowing user consent only for apps from verified publishers, and documents turning user consent off through Microsoft Graph or PowerShell. Where the user consent setting lives has the steps.

What is consent phishing?

Consent phishing is when an attacker tricks someone into approving a malicious app instead of stealing their password. Microsoft describes attacks that “trick users into granting permissions to malicious cloud applications”, which can then access cloud services and users’ data. Microsoft notes that because a legitimate provider hosts the consent screen, unsuspecting users accept. What consent phishing is explains how it differs from credential theft.

Can users approve apps in Microsoft 365 by default?

Yes, for some permissions. Microsoft’s documentation states that by default “all users are allowed to consent to applications for permissions that don’t require administrator consent”. Microsoft’s example is that a user can consent to an app reading their own mailbox, but not to an app having unrestricted read and write access to all files in the organisation. How user consent works by default has the detail.

What is the admin consent workflow in Entra ID?

The admin consent workflow lets users who can’t consent to an app send a request for admin approval instead. Microsoft says the request goes by email to designated reviewers, the user is told the outcome, and being a reviewer doesn’t raise someone’s privileges. Turning it on needs a Global Administrator, and Microsoft says it can take up to an hour to become enabled. Admin consent workflow has the steps.

Do new consent settings remove apps people already approved?

No. Microsoft states that updates to user consent settings “only affect future consent operations”, so existing grants remain. Microsoft’s instructions show an app’s permissions under Enterprise apps > All applications > Permissions, with Admin consent and User consent tabs. Microsoft says user-consented permissions can’t be revoked in the portal and describes Microsoft Graph or PowerShell for those. Existing consents walks through the review.

What do I do if someone approved a malicious app?

Microsoft’s consent-phishing guidance describes investigating the app’s activity and the permissions it requested, reviewing Entra audit logs for its activity, and checking sign-ins by users who authorised it. Microsoft also describes following its guidance on defending against illicit consent grants. What Microsoft’s guidance describes if a malicious app is found has the list, and the compromised account checklist covers an account that may also be compromised.

Related guides

• Microsoft 365 security baseline
• Security defaults vs Conditional Access