# Ensure `User consent for applications` is set to `Do not allow user consent`

- Source: https://support.icompaas.com/support/solutions/articles/62000229790-ensure-user-consent-for-applications-is-set-to-do-not-allow-user-consent-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This control ensures that Microsoft Entra ID is configured to prevent users from granting application permissions without administrator approval. Disabling user consent protects the tenant from malicious or unverified applications gaining access to organizational data and reduces the risk of data leakage through excessive or inappropriate permissions.

  

Rationale:

Allowing user consent can expose the environment to rogue or compromised applications requesting sensitive permissions. Restricting consent ensures IT administrators review and approve application access, improving control over data sharing and reducing the chance of unauthorized access.

  

Impact:

Users will no longer be able to independently authorize third-party applications. Requests for new apps will require administrator approval, which may slightly increase support requests. However, centralized approval significantly enhances security, governance, and visibility over application permissions

.

Default:

By default, Microsoft Entra ID allows limited user consent for applications unless modified. This setting must be manually updated to “Do not allow user consent” to fully restrict end-user authorization.

  

Pre-requisites:

-   Global Administrator or Privileged Role Administrator permissions to modify the user consent settings.
    
-   A process for managing application consent requests from users to administrators.
    

  

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Microsoft Entra ID
    
3.  Under the Manage section, select Enterprise applications
    
4.  Under the Security section, select Consent and Permissions
    
5.  Open User consent settings
    
6.  Verify User consent for applications is set to Do not allow user consent
    
7.  If User consent for applications is not set to Do not allow user consent, follow the implementation steps
    

  

Implementation Steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Microsoft Entra ID
    
3.  Under the Manage section, select Enterprise applications
    

                                      ![](https://support.icompaas.com/assets/kb/70ac37ae40e95467.png)

4.  In the left-hand menu under the security section, select Consent and Permissions
    

                             ![](https://support.icompaas.com/assets/kb/0a3e93288712f5b3.png)

5.  Open User consent settings
    
6.  Set User consent for applications to Do not allow user consent
    

![](https://support.icompaas.com/assets/kb/b32de150bee8b87f.png)

7.  Click Save to apply the changes.
    

####   

#### Backout Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Microsoft Entra ID
    
3.  Under the Manage section, select Enterprise applications
    
4.  Select Consent and permissions
    
5.  Open User consent settings
    
6.  Change User consent for applications to the previously allowed setting
    
7.  Save the changes
    

  

References:

-   [https://docs.microsoft.com/en-us/azure/active-directory/external-identities/consent-to-applications](https://docs.microsoft.com/en-us/azure/active-directory/external-identities/consent-to-applications)
    
-   [https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-are-enterprise-applications](https://docs.microsoft.com/en-us/azure/active-directory/external-identities/consent-to-applications)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.