User Consent Settings
Control whether and how end users can grant consent to applications. Options include allowing consent only for apps from verified publishers (and predefined permissions), allowing consent to any app, or disabling user consent entirely — forcing administrator review and approval.
Settings this baseline controls
| Setting | What it does |
|---|---|
| User consent policy | Controls what permissions users can grant to applications. Recommended setting allows consent only for verified publishers with selected permissions. Learn more |
Configure it
This baseline stops users granting broad permissions to any app they like, while still letting them install low-risk apps from verified publishers without waiting on an admin.
-
Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).
-
Set User consent policy to allow consent only for apps from verified publishers, for a pre-selected set of low-risk permissions, rather than allowing consent to any app or disabling user consent outright.
-
Save. Auto-remediation is safe to turn on: it only re-asserts which policy applies to future consent, and never touches permissions a user has already granted.
Pair this with Admin Consent Workflow so a user who hits an app outside this policy has a request flow to fall back on, instead of a dead end.
Check it worked
Passing means Entra ID → Enterprise apps → Consent and permissions → User consent settings shows the verified-publisher, selected-permissions option chosen. Users trying a low-risk app from a verified publisher can still consent themselves; anyone hitting an app outside that policy sees “Need admin approval” instead.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.