Admin Consent Workflow
Control how users request approval for apps that need high-level permissions. When a user tries to access an app requiring admin consent, their request is routed to designated reviewers, who can approve or deny it with a full audit trail. This ensures only vetted apps gain elevated access.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Admin consent requests enabled | Allows end users to request admin consent to applications they cannot consent to themselves. Learn more |
| Reviewer notifications enabled | Specifies whether reviewers receive notifications when consent requests are submitted. Learn more |
| Reminder emails enabled | Specifies whether reviewers receive reminder emails for pending admin consent requests. Learn more |
| Request expiry in days | Specifies the duration after which admin consent requests expire if no decision is made. Learn more |
| Request reviewers | Specifies the list of users or groups who can review admin consent requests. Learn more |
Configure it
Add this to a tenant when you want end users to be able to request access to apps that need admin-level permissions, instead of being silently blocked or raising a ticket each time.
-
Add the baseline to the tenant directly (Adding a baseline), or roll it out to every tenant you manage through a scheme (Deploying a scheme).
-
Turn on Admin consent requests enabled so users get a request flow instead of a dead end.
-
Set Request reviewers to at least one person or group who can act on requests. Without a reviewer, requests pile up with no one to approve them.
-
Turn on Reviewer notifications enabled and Reminder emails enabled so reviewers see new and about-to-expire requests, and set Request expiry in days to 10 so a stale request doesn’t sit open indefinitely.
-
Save. Turn on Auto-remediation if you want Octiga to restore these settings whenever someone switches the workflow off or clears the reviewer list in Microsoft Entra.
Check it worked
Passing means the tenant’s admin consent workflow is on with at least one reviewer. You can see this in the Microsoft Entra admin centre under Entra ID → Enterprise apps → Consent and permissions → Admin consent settings. The next time an end user opens an app that needs admin approval, they get an Approval required prompt and can submit a request; reviewers act on it from the same screen’s Admin consent requests pane.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.