Skip to content
MitoMito Docs

CISA.MS.AAD.5.3: An admin consent workflow SHALL be configured for applications.
ID CISA.MS.AAD.5.3
Severity High
Suite CISA SCuBA baselines
Product Entra ID
Feature App consent and permissions
Security area Applications and workload identities
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Benchmark CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.5.3 (SHALL)
Framework controls cisa-scuba:MS.AAD.5.3
nist-800-53-r5:CM-4 Impact Analyses
MITRE ATT&CK T1098.001, T1098.003, T1528
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

An admin consent workflow SHALL be configured for applications.

Rationale: Configuring an admin consent workflow reduces the risk of the previous policy by setting up a process for users to securely request access to applications necessary for business purposes. Administrators have the opportunity to review the permissions requested by new applications and approve or deny access based on a risk assessment.

Remediation action:

Section titled “Remediation action:”
  1. In Entra create a new Group that contains admin users responsible for reviewing and adjudicating application consent requests. Group members will be notified when users request consent for new applications.
  2. Then in Entra under Identity and Applications, select Enterprise applications.
  3. Under Security, select Consent and permissions.
  4. Under Manage, select Admin consent settings.
  5. Under Admin consent requests and Users can request admin consent to apps they are unable to consent to select Yes.
  6. Under Who can review admin consent requests, select + Add groups and select the group responsible for reviewing and adjudicating app requests (created in step one above).
  7. Click Save.
Section titled “Related links”

Mito check, based on CISA ScubaGear. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.