What this check looks at
Checks whether owners of Microsoft 365 groups and Teams may let apps access their group’s data without an administrator.
Microsoft Entra ID can let owners of Microsoft 365 groups and Teams consent to apps that access their own group’s data (its files, chats, channel messages or calendar) without an administrator. This is group owner or resource-specific consent, controlled by the consent policies assigned to ordinary users. Microsoft-managed policies allow team and chat owners to consent to certain low-risk permissions that Microsoft chooses.
This check reads which consent policies apply to ordinary users. It passes when none of them lets owners consent for resources they own. It warns when only Microsoft’s dynamically managed team and chat policies are assigned. The check fails when any other owner consent policy is assigned, letting group owners consent to apps for their groups.
Anyone who owns a team can then become the route for an illicit consent attack: one convincing prompt, accepted by the owner, gives an app access to that whole team’s conversations and files. These grants never appear as tenant-wide consent and are easy to miss, and a team owner usually has no way to judge whether an app is safe.
Why it matters
An owner consenting for their team lets an app read that team’s chats, files and calendar. It is the same illicit-consent risk as user consent, at the scale of a whole team, and it is easy to miss because it never appears as a tenant-wide grant.
In a 150-person firm, the owner of the Bids team adds a free meeting-notes app and consents for the team. The app can now read every channel message and file in the team, including pricing for live tenders. When the app’s developer is breached, the bid documents are exposed, and nobody in IT knew the app existed.
Turning owner consent off is one setting, and owners who need an app can use the admin consent workflow, so legitimate requests are still approved, with a record.
CIS Controls v8 safeguard 4.1, ISO 27001 A.5.15 and A.5.19, and the NCSC 10 Steps and CAF supply chain outcomes expect third-party access to company data to be authorised centrally. The CISA and CIS Microsoft 365 baselines ask for group owner consent to be turned off.
How to fix it
Where: Entra admin centre → Enterprise applications → Consent and permissions
Before you start
- Check Enterprise applications for apps team owners have consented to, and review whether each is still needed.
Step by step
- Review consents owners have already given. In the Microsoft Entra admin centre, go to Entra ID > Enterprise apps > All applications and review recently added apps. In Microsoft Graph PowerShell, Get-MgGroupPermissionGrant -GroupId <group id> lists the resource-specific grants on a team. Remove any that are not needed with Remove-MgGroupPermissionGrant.
- Open the user consent settings. Go to Entra ID > Enterprise apps > Consent and permissions > User consent settings.
- Turn off group owner consent. Under Group owner consent for apps accessing data, choose Do not allow group owner consent and select Save.
- Or remove the owner consent policies with PowerShell. In Microsoft Graph PowerShell (Connect-MgGraph -Scopes Policy.ReadWrite.Authorization), read the current list with (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.PermissionGrantPoliciesAssigned, then set it again without the entries starting ManagePermissionGrantsForOwnedResource, for example Update-MgPolicyAuthorizationPolicy -BodyParameter @{ defaultUserRolePermissions = @{ permissionGrantPoliciesAssigned = @("ManagePermissionGrantsForSelf.microsoft-user-default-low") } }, keeping whichever ManagePermissionGrantsForSelf entry was there before.
- Point owners to the admin consent workflow. Make sure the admin consent workflow is on (Consent and permissions > Admin consent settings) and tell team owners that apps for their team are now requested there.
- Confirm owner consent is off. Reopen User consent settings and check group owner consent shows Do not allow, or run (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.PermissionGrantPoliciesAssigned and check no entry starts ManagePermissionGrantsForOwnedResource. The finding clears at the next assessment.
What users will notice
Team owners can no longer approve apps for their team themselves; they request approval instead.
How to confirm it worked
Entra ID, Enterprise applications, Consent and permissions, User consent settings: group owner consent shows "Do not allow".
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A4.a Supply chainB2.d Identity and access management (IdAM) |
| DSPT | Standard 10: Accountable suppliers |
| DORA | Art. 28 Management of ICT third-party risk |
| NIS2 | Art. 21(2)(d) Supply chain security |
| Microsoft Cloud Security Benchmark | IM-3 Manage application identities securely and automatically |
| Zero Trust | Applications |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.15 Access controlA.5.19 Information security in supplier relationships |
| CIS Controls v8.1 | 4.1 Establish and maintain a secure configuration process (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access managementSupply chain security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Configure group owner consent (Microsoft Learn)