The admin consent workflow protects your tenant from consent phishing

Consent phishing is still a big problem in 2026. In almost every Entra tenant I review, I find at least one suspicious app holding far more permissions than it needs. Users click through consent prompts without much thought (including people who really should know better) and hand third-party apps access to email, files or calendars. Most organisations still allow some form of user consent to apps by default, and attackers are well aware of that. Incidents like Midnight Blizzard showed this again very clearly (see my write-up).

Restricting user consent is the first step

The quickest fix is usually also the simplest one. In the Entra admin center, go to Enterprise applications → Consent and permissions → User consent settings and set the default to "Allow user consent for apps from verified publishers, for selected permissions (low impact)" or, better still, "Do not allow user consent". That stops unvetted apps and risky permission requests from getting into the tenant at all. Most tenants don’t need exceptions here. Microsoft documents these options in detail.

Practical tip: Restricting user consent is only the beginning. Go through your app and service principal inventory regularly and look for old, overly broad or unused grants. Legacy permissions pile up fast, especially in older tenants.

The admin consent workflow only works with active reviewers

Some legitimate apps will always need broader permissions, Teams integrations or workflow automations for example. This is what the admin consent workflow is for. You’ll find it under Enterprise applications → Consent and permissions as well, and enabling it takes about a minute. From then on, a user who runs into an app that needs more access than allowed can send an admin consent request to a defined group of reviewers. The reviewers are notified, see the request details and approve or reject it directly in the portal. Microsoft’s documentation walks through the process step by step.

For the admin consent workflow to hold up in practice, a few things matter:

• Choose your reviewers carefully (security admins, app owners)
• Make sure someone actually watches the notifications
• Define clear approval criteria
• Document every decision (ideally in your ticketing system)

The diagram below shows the process:

flowchart TD
  User["User discovers app"] --> Request["Request admin consent"]
  Request --> Reviewer["Reviewer checks request"]
  Reviewer --> Decision["Approve or reject"]
  Decision --> Admin["Admin grants consent (if approved)"]
  Decision --> NoConsent["No consent (if rejected)"]

Figure: The admin consent workflow with reviewers

Many organisations I work with switch the admin consent workflow on and then forget about it. The reviewer groups are out of date, or nobody reads the notifications, and at that point the whole thing is pointless. Set up properly and actually used, though, it gives you real transparency and a clean audit trail for app approvals.

Existing grants and app governance need regular review

Then comes the clean-up, because you also need to know what access has already been granted. Under Enterprise applications → Permissions in the Entra admin center you can list all user and admin consents and revoke them where needed. Look closely at apps with broad permissions ("Mail.ReadWrite", "User.Read.All") or from unverified publishers.

Compromised OAuth apps are exactly how attackers like Midnight Blizzard got in. My post on app governance describes practical steps for finding and assessing risky app consents. If you’re licensed for Microsoft Defender for Cloud Apps or app governance features, turn on the app governance alerts and follow up on them. They flag risky or unusual app behaviour that you would otherwise miss.

Consent remains an ongoing responsibility

Enabling the admin consent workflow is not a box you tick once. The technical setup is quick. The actual protection comes from holding reviewers accountable and making app governance a normal part of security operations. With attacks as sophisticated as they are today, strict control is the safest approach, and reviewing app consents now belongs in every Microsoft cloud security strategy.