Skip to content
MitoMito Docs

CISA.MS.AAD.5.2: Only administrators SHALL be allowed to consent to applications.
ID CISA.MS.AAD.5.2
Severity High
Suite CISA SCuBA baselines
Product Entra ID
Feature App consent and permissions
Security area Applications and workload identities
Resource type Tenant
User impact of fixing Medium
Effort to fix Low
Benchmark CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.5.2 (SHALL)
Framework controls cisa-scuba:MS.AAD.5.2
nist-800-53-r5:AC-6(10) Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions
nist-800-53-r5:CM-5 Access Restrictions for Change
MITRE ATT&CK T1098.001, T1098.003, T1528, T1566.002
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Only administrators SHALL be allowed to consent to applications.

Rationale: Limiting applications consent to only specific privileged users reduces risk of users giving insecure applications access to their data via consent grant attacks.

Remediation action

Section titled “Remediation action”
  1. In Entra under Identity and Applications, select Enterprise applications.
  2. Under Security, select Consent and permissions.
  3. Under Manage, select User consent settings.
  4. Under User consent for applications, select Do not allow user consent.
  5. Click Save.
Section titled “Related links”

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: merill. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.