# Admin Consent Workflow

> Control how users request approval for apps that need high-level permissions.

Control how users request approval for apps that need high-level permissions. When a user tries to access an app requiring admin consent, their request is routed to designated reviewers, who can approve or deny it with a full audit trail. This ensures only vetted apps gain elevated access.

## Settings this baseline controls

| Setting                        | What it does                                                                                                                                                                               |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Admin consent requests enabled | Allows end users to request admin consent to applications they cannot consent to themselves. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/adminconsentrequestpolicy) |
| Reviewer notifications enabled | Specifies whether reviewers receive notifications when consent requests are submitted. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/adminconsentrequestpolicy)       |
| Reminder emails enabled        | Specifies whether reviewers receive reminder emails for pending admin consent requests. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/adminconsentrequestpolicy)      |
| Request expiry in days         | Specifies the duration after which admin consent requests expire if no decision is made. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/adminconsentrequestpolicy)     |
| Request reviewers              | Specifies the list of users or groups who can review admin consent requests. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/adminconsentrequestpolicy)                 |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

Add this to a tenant when you want end users to be able to request access to apps that need admin-level permissions, instead of being silently blocked or raising a ticket each time.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or roll it out to every tenant you manage through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Turn on **Admin consent requests enabled** so users get a request flow instead of a dead end.
3. Set **Request reviewers** to at least one person or group who can act on requests. Without a reviewer, requests pile up with no one to approve them.
4. Turn on **Reviewer notifications enabled** and **Reminder emails enabled** so reviewers see new and about-to-expire requests, and set **Request expiry in days** to 10 so a stale request doesn't sit open indefinitely.
5. Save. Turn on **Auto-remediation** if you want Octiga to restore these settings whenever someone switches the workflow off or clears the reviewer list in Microsoft Entra.

## Check it worked

Passing means the tenant's admin consent workflow is on with at least one reviewer. You can see this in the Microsoft Entra admin centre under **Entra ID → Enterprise apps → Consent and permissions → Admin consent settings**. The next time an end user opens an app that needs admin approval, they get an **Approval required** prompt and can submit a request; reviewers act on it from the same screen's **Admin consent requests** pane.

## Standards this addresses

### CIS

- **M365 5.1.5.2** — CIS M365 Foundations Benchmark 5.1.5.2
- **v8 6.8** — CIS Controls v8 Safeguard 6.8

### NIST

- **PR.AC-6** — NIST CSF 2.0 PR.AC-6
- **AC-3** — NIST SP 800-53 AC-3
- **AC-6** — NIST SP 800-53 AC-6

### ISO 27001

- **A.8.11** — ISO/IEC 27001:2022 Annex A.8.11

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)