CIS.M365.5.1.5.2: Ensure the admin consent workflow is enabled

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.5.1.5.2
Severity	High
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Entra ID
Feature	App consent and permissions
Security area	Applications and workload identities
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 5.1.5.2 (L1, E3 Level 1, E5 Level 1)
Framework controls	cis-m365:5.1.5.2 nist-800-53-r5:CM-4 Impact Analyses
MITRE ATT&CK	T1528
Reads from	Microsoft Graph

What this checks and how to fix it

5.1.5.2 (L1) Ensure the admin consent workflow is enabled

The admin consent workflow gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer takes action on the request, and the user is notified of the action.

Rationale

The admin consent workflow (Preview) gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer acts on the request, and the user is notified of the action.

Impact

To approve requests, a reviewer must be a Global Administrator, Cloud Application Administrator, or Application Administrator. The reviewer must already have one of these admin roles assigned; simply designating them as a reviewer doesn’t elevate their privileges.

Remediation action

1. Navigate to Microsoft Entra ID admin center.
2. Under Entra ID select Enterprise apps
3. Under Security select Consent and permissions
4. Under Manage select Admin consent settings
5. Set Users can request admin consent to apps they are unable to consent to to Yes
6. Click Save.

Related links

• Microsoft Entra ID admin center
• Configure the admin consent workflow
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 242

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: oed-metzb; contributors: Mynster9361. Open-source licences.