What it decides
- Rule
ENTRA-AUTH-002- Applies to
entra·authorization-policy- Default severity
- high
- Basis
- documented-guidance
On what authority
Microsoft writes the recommendation into the property's own description: "We recommend keeping allowUserConsentForRiskyApps as `false`. Default value is `false`." Two facts follow and both matter. The position is Microsoft's, so a finding here is not this engine's opinion about consent. And `false` is the default, so `true` is a value somebody set: the finding is a record of a decision rather than of an omission, and the remediation is a conversation with whoever made it rather than a configuration change nobody has to explain.
What it needs to decide
authorization_policy.user_consent_for_risky_apps
Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.
Where the evidence comes from
tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated
What a pass does not establish
THIS IS ONE SETTING ABOUT ONE CATEGORY OF APPLICATION. A tenant where this is false still allows user consent to every application Microsoft has not flagged, under whatever app consent policy the default user role holds. The collector publishes how many consent policies are assigned; this rule does not read them.
- Which applications Microsoft flags is decided by Microsoft and changes without notice to the tenant. A pass records that the tenant defers to that judgement, not that no risky application was ever consented to.
- Consent already granted is unaffected by this setting. Turning it off stops new grants and revokes nothing.
Source
The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.
Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.