EIDSCA.CR04: Consent Framework - Admin Consent Request - Consent request duration (days).

ID	EIDSCA.CR04
Severity	Low
Suite	EIDSCA
Product	Entra ID
Feature	App consent and permissions
Security area	Applications and workload identities
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Reads from	Microsoft Graph

What this checks and how to fix it

Specifies the duration the request is active before it automatically expires if no decision is applied

Test script

https://graph.microsoft.com/beta/policies/adminConsentRequestPolicy
.requestDurationInDays -le 30

Related links

• Open in Graph Explorer
• adminConsentRequestPolicy resource type - Microsoft Graph v1.0 | Microsoft Learn
• View in Microsoft Entra admin center

MITRE ATT&CK

mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0001 - Initial Access - Initial Access
      TA0005 - Defense Evasion - Stealth
      TA0006 - Credential Access - Credential Access
      TA0008 - Lateral Movement - Lateral Movement
    (Mitigation)
      M1018 - User Account Management
      M1017 - User Training
    (Technique)
      T1078 - Valid Accounts
      T1528 - Steal Application Access Token
      T1550 - Use Alternate Authentication Material
      T1550.001 - Use Alternate Authentication Material: Application Access Token
      T1566.002 - Phishing: Spearphishing Link

Tactic	Technique	Mitigation
TA0001 - Initial Access - Initial Access TA0005 - Defense Evasion - Stealth TA0006 - Credential Access - Credential Access TA0008 - Lateral Movement - Lateral Movement	T1078 - Valid Accounts T1528 - Steal Application Access Token T1550 - Use Alternate Authentication Material T1550.001 - Use Alternate Authentication Material: Application Access Token T1566.002 - Phishing: Spearphishing Link	M1018 - User Account Management M1017 - User Training

---

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.