Configure how users consent to applications

Configure user consent in Microsoft Entra admin center

To configure user consent settings through the Microsoft Entra admin center:

1. Sign in to the Microsoft Entra admin center as a Global Administrator.

2. Browse to Entra ID > Enterprise apps > Consent and permissions > User consent settings.

3. Under User consent for applications, select which consent setting you want to configure for all users.

4. Select Save to save your settings.

Understand authorization and permission grant policies in Microsoft Graph PowerShell

To configure user consent settings programmatically using Microsoft Graph PowerShell, it's important to understand the distinction between the tenant-wide authorization policy and individual permission grant policies. The authorizationPolicy, retrieved using Update-MgPolicyAuthorizationPolicy governs global settings such as whether users can consent to apps and which permission grant policies are assigned to the default user role. For example, you can disable user consent while still allowing developers to manage permissions for the apps they own by assigning only ManagePermissionGrantsForOwnedResource.DeveloperConsent in the permissionGrantPoliciesAssigned collection.

On the other hand, the permissionGrantPolicies endpoint, lists all defined consent policies in the tenant. These policies determine the specific types of app permissions that users are allowed to grant—such as low-risk delegated permissions. For instance, a policy like UserConsentLowRisk might allow users to consent only to apps that request basic profile information, while a custom policy could restrict consent even further or broaden it for specific user groups.

To choose which app consent policy governs user consent for applications, use the Microsoft Graph PowerShell module. The cmdlets used here are included in the Microsoft.Graph.Identity.SignIns module.

Connect to Microsoft Graph PowerShell using the least-privilege permission needed. For reading the current user consent settings, use Policy.Read.All. For reading and changing the user consent settings, use Policy.ReadWrite.Authorization. You need to sign in as a Privileged Role Administrator.

Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"

Disable user consent using Microsoft Graph PowerShell

To disable user consent, ensure that the consent policies (PermissionGrantPoliciesAssigned) include other current ManagePermissionGrantsForOwnedResource.* policies if any while updating the collection. This way, you can maintain your current configuration for user consent settings and other resource consent settings.

# only exclude user consent policy
$body = @{
    "permissionGrantPolicyIdsAssignedToDefaultUserRole" = @(
        "managePermissionGrantsForOwnedResource.{other-current-policies}" 
    )
}
Update-MgPolicyAuthorizationPolicy -BodyParameter $body

Allow user consent subject to an app consent policy using PowerShell

To allow user consent, choose which app consent policy should govern users' authorization to grant consent to apps. Ensure that the consent policies (PermissionGrantPoliciesAssigned) include other current ManagePermissionGrantsForOwnedResource.* policies if any while updating the collection. This way, you can maintain your current configuration for user consent settings and other resource consent settings.

$body = @{
    "permissionGrantPolicyIdsAssignedToDefaultUserRole" = @(
        "managePermissionGrantsForSelf.{consent-policy-id}",
        "managePermissionGrantsForOwnedResource.{other-current-policies}"
    )
}
Update-MgPolicyAuthorizationPolicy -BodyParameter $body

Replace {consent-policy-id} with the ID of the policy you want to apply. You can choose a custom app consent policy that you've created, or you can choose from the following built-in policies:

For example, to enable user consent subject to the built-in policy microsoft-user-default-low, run the following commands:

$body = @{
    "permissionGrantPolicyIdsAssignedToDefaultUserRole" = @(
        "managePermissionGrantsForSelf.managePermissionGrantsForSelf.microsoft-user-default-low",
        "managePermissionGrantsForOwnedResource.{other-current-policies}"
    )
}

Understand authorization and permission grant policies in Microsoft Graph

To configure user consent settings programmatically using Microsoft Graph, it's important to understand the distinction between the tenant-wide authorization policy and individual permission grant policies. The authorizationPolicy (retrieved using GET https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy) governs global settings such as whether users can consent to apps and which permission grant policies are assigned to the default user role. For example, you can disable user consent while still allowing developers to manage permissions for the apps they own by assigning only ManagePermissionGrantsForOwnedResource.DeveloperConsent in the permissionGrantPoliciesAssigned collection.

On the other hand, the permissionGrantPolicies endpoint (GET https://graph.microsoft.com/v1.0/policies/permissionGrantPolicies) lists all defined consent policies in the tenant. These policies determine the specific types of app permissions that users are allowed to grant—such as low-risk delegated permissions. For instance, a policy like UserConsentLowRisk might allow users to consent only to apps that request basic profile information, while a custom policy could restrict consent even further or broaden it for specific user groups.

Use the Graph Explorer to choose which app consent policy governs user consent for applications. You need to sign in as a Privileged Role Administrator.

Disable user consent using Microsoft Graph

To disable user consent, ensure that the consent policies (PermissionGrantPoliciesAssigned) include other current ManagePermissionGrantsForOwnedResource.* policies if any while updating the collection. This way, you can maintain your current configuration for user consent settings and other resource consent settings.

PATCH https://graph.microsoft.com/v1.0/policies/authorizationPolicy
{
   "defaultUserRolePermissions": {
       "permissionGrantPoliciesAssigned": [
           "managePermissionGrantsForOwnedResource.{other-current-policies}"
        ]
    }
}

Allow user consent subject to an app consent policy using Microsoft Graph

To allow user consent, choose which app consent policy should govern users' authorization to grant consent to apps. Ensure that the consent policies (PermissionGrantPoliciesAssigned) include other current ManagePermissionGrantsForOwnedResource.* policies if any while updating the collection. This way, you can maintain your current configuration for user consent settings and other resource consent settings.

PATCH https://graph.microsoft.com/v1.0/policies/authorizationPolicy

{
    "defaultUserRolePermissions": {
        "managePermissionGrantsForSelf.{consent-policy-id}",
        "managePermissionGrantsForOwnedResource.{other-current-policies}"
   }
}

Replace {consent-policy-id} with the ID of the policy you want to apply. You can choose a custom app consent policy that you've created, or you can choose from the following built-in policies:

For example, to enable user consent subject to the built-in policy microsoft-user-default-low, use the following PATCH command:

PATCH https://graph.microsoft.com/v1.0/policies/authorizationPolicy

{
    "defaultUserRolePermissions": {
        "permissionGrantPoliciesAssigned": [
            "managePermissionGrantsForSelf.microsoft-user-default-low",
            "managePermissionGrantsForOwnedResource.{other-current-policies}"
        ]
    }
}