📖 What is Microsoft Entra ID App Consent?
Microsoft Entra ID App Consent is the process where a user or administrator grants a third-party application permission to access specific data in the tenant. This ensures that apps only access the resources they are explicitly authorized to use via OAuth 2.0 scopes.
"Admins can configure 'Admin Consent' to grant permissions for the entire organization, preventing every individual user from seeing the consent prompt."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Microsoft Entra ID App Consent?
- ▸ OAuth 2.0 Scopes define the specific level of access an application requests, such as reading a user's profile or sending emails on their behalf.
- ▸ User Consent allows individuals to authorize apps for low-risk permissions, whereas Admin Consent is required for high-privilege scopes or organization-wide access.
- ▸ Delegated permissions allow an app to act on behalf of the signed-in user, while Application permissions allow the app to run as a background service.
- ▸ The Enterprise Applications blade in the Entra admin center is where administrators manage, review, and revoke existing app consents for the tenant.
- ▸ Admin consent workflows allow users to request permission for an app, which an administrator can then review and approve or deny centrally.
🎯 How does Microsoft Entra ID App Consent appear on the MS-102 Exam?
You may be asked to determine the correct configuration to prevent users from consenting to any third-party applications, requiring all apps to be pre-approved by an administrator.
A scenario might describe a user receiving a 'Need admin approval' message when attempting to sign into a productivity app; you must identify the missing admin consent.
Expect questions about the difference between delegated and application permissions when deciding whether a user or a global administrator must grant the app consent.
❓ Frequently Asked Questions
What is the difference between Delegated and Application permissions regarding consent?
Delegated permissions require a user to be present to consent and act as that user. Application permissions are used by services without a user and always require administrator consent.
What happens to the user experience after an administrator grants tenant-wide consent?
Users will no longer see the consent prompt when signing into the application, as the administrator has already authorized the requested permissions for all users in the tenant.
Can an administrator restrict user consent to only 'verified publishers'?
Yes, in the Entra ID user consent settings, admins can allow users to consent to apps from verified publishers, reducing the risk of malicious third-party applications.