Question

Your organization has experienced several incidents where users granted broad delegated permissions to unverified third-party OAuth applications. You want users to be able to continue consenting to applications on their own behalf, but only for apps that are from verified publishers and that request permissions you classify as low-impact. You do not want to disable user consent entirely. What should you configure in Microsoft Entra ID?

Accepted Answer

Configure a user consent setting that allows consent only for apps from verified publishers for selected (low-impact) permissions, and define those permission classifications.

Answer

Disable user consent for applications and require an admin consent workflow for every app request.

Answer

Create a Conditional Access policy that blocks access to all cloud apps unless the app is registered by a verified publisher.

Answer

Enable the group consent setting so that only group owners can consent to applications on behalf of members.