# User Consent Settings

> Control whether and how end users can grant consent to applications.

Control whether and how end users can grant consent to applications. Options include allowing consent only for apps from verified publishers (and predefined permissions), allowing consent to any app, or disabling user consent entirely — forcing administrator review and approval.

## Settings this baseline controls

| Setting             | What it does                                                                                                                                                                                                                                                                      |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| User consent policy | Controls what permissions users can grant to applications. Recommended setting allows consent only for verified publishers with selected permissions. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent?tabs=azure-portal) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline stops users granting broad permissions to any app they like, while still letting them install low-risk apps from verified publishers without waiting on an admin.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Set **User consent policy** to allow consent only for apps from verified publishers, for a pre-selected set of low-risk permissions, rather than allowing consent to any app or disabling user consent outright.
3. Save. **Auto-remediation** is safe to turn on: it only re-asserts which policy applies to future consent, and never touches permissions a user has already granted.

Pair this with [Admin Consent Workflow](https://docs.octiga.io/baselines/access-management/admin-consent-workflow/) so a user who hits an app outside this policy has a request flow to fall back on, instead of a dead end.

## Check it worked

Passing means **Entra ID → Enterprise apps → Consent and permissions → User consent settings** shows the verified-publisher, selected-permissions option chosen. Users trying a low-risk app from a verified publisher can still consent themselves; anyone hitting an app outside that policy sees "Need admin approval" instead.

## Standards this addresses

### CIS

- **M365 5.1.5.1** — CIS M365 Foundations Benchmark 5.1.5.1
- **v8 6.8** — CIS Controls v8 Safeguard 6.8

### NIST

- **PR.AC-6** — NIST CSF 2.0 PR.AC-6
- **AC-3** — NIST SP 800-53 AC-3
- **AC-6** — NIST SP 800-53 AC-6

### ISO 27001

- **A.8.11** — ISO/IEC 27001:2022 Annex A.8.11

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)