Secure Your Environment by Managing User Consent to Applications in Azure AD (Entra ID)

-


Why Should You Do This?

Managing user consent to applications in Azure AD (Entra ID) is crucial to enhance security and protect your organization’s sensitive data. Unaware users may inadvertently approve malicious apps that request access to resources like OneDrive files or SharePoint sites, even offline. This can lead to data theft through phishing or compromised accounts, bypassing multifactor authentication (MFA) as certain protocols (e.g., SMTP, POP3, IMAP) are not covered post-authentication.



Default Settings and Risks

Default Azure AD settings allow users to approve third-party apps without administrator oversight, increasing the risk of data breaches. Users are often the weakest link in security, making stricter settings essential.

How to Configure User Consent

You need a user account with a Global Administrator role to manage these settings. The following options are available:

  1. Do Not Allow User or Group Owner Consent
    • Blocks all users from approving apps.
    • Steps:
      • Log in to the Azure portal.
      • Go to Azure Active Directory > Enterprise Applications > Consent and Permissions > User Consent Settings.

      • Select "Do not allow user consent" and save.




  2. Allow Consent Only for Apps from Verified Publishers
    • Restricts user consent to apps from Microsoft-certified publishers.
    • Steps:
      • Go to Azure Active Directory > Enterprise Applications > Consent and Permissions > User Consent Settings.

      • Select "Allow users consent for apps from verified publishers" and save.
  3. Enable Admin Consent Workflow
    • Allows users to request admin approval for apps they cannot consent to themselves.
    • Steps:
      • Go to Azure Active Directory > Enterprise Applications > User Settings.
      • Set "User can request admin consent to apps they are unable to consent to" to "YES" and save.

Conclusion

By implementing these settings, you reduce your attack surface and safeguard your organization’s data from unauthorized access. Choose the method that best aligns with your security needs. 

Kommentarer

Skicka en kommentar

Populära inlägg i den här bloggen

Boost Your Graphics Power med GPU-acceleration i Azure Virtual Desktop!

-
Bild
  🎯 Purpose Optimize performance for Remote Desktop sessions by enabling GPU acceleration and video optimization via Microsoft Intune or Group Policy (GPO). 🧠 Prerequisites & Requirements Required skills: Basic knowledge of Windows device management Experience with Microsoft Intune or Group Policy Understanding of Remote Desktop (RDP/AVD) concepts Technical requirements: Windows 10/11 on session hosts GPU-enabled VMs (e.g., NVv3, NVadsA10 v5, NCasT4_v3) Microsoft HEVC codec installed on client devices Proper GPU drivers installed (NVIDIA GRID or AMD) 1. Sign in Go to: https://intune.microsoft.com 2. Create or edit a configuration profile Go to Devices > Configuration profiles Click Create profile Select: Platform: Windows 10 and later Profile type: Settings catalog 3. Add settings Click Add settings and browse to: Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host ...
Read more »

🚀 IntuneWin – Deploying Win32 Apps via Intune 🎯

-
Bild
🔹 Benefits of IntuneWin: ✅ Seamless app packaging 📦 ✅ Automated deployment ⚙️ ✅ Centralized cloud management ☁️ ✅ Support for installation & uninstallation 🔄 The IntuneWin format is a method for preprocessing Windows Classic (Win32) applications. The tool transforms application installation files into the .intunewin format. Once you apply this tool to the app packaging folder, you can create an app enrollment configuration that enables advanced deployment features, such as OS version dependencies and uninstallation methods for remote application removal. Win32 apps in Intune size limit of 30 GB per app. To start the configuration 1- First you need to download the Microsoft Win32 Content Prep Tool :  Microsoft Win32 Content Prep Tool 2-  Unzip the tool to a folder, E, C , F etc drive (you can choose any folder you like). 3- Save your application  in the same folder as the Content Prep tools.  4- Now we will create the .intunewin package using PowerS...
Read more »

Block Personal devices to acces to Desktop apps like teams, Onedrive etc and how to troubleshooting the issue.

-
Bild
  You can use Conditional Access to block users based on location, IP address, and more, but now we will talk about blocking access for users who are using personal devices 1. Navigate to Entra ID -> Protection -> Conditional Access and create a new policy. 2- Create new policy 3-   Name your policy Assign your policy to a user/group or to all users. If you assign the policy to all users, be sure to exclude the break-glass account. It's essential to always have a break-glass account in place. In case of an error, you could accidentally lock out all users, so make sure these accounts remain unaffected. 4- In the Target resources select All resources (formerly 'All cloud apps') 5- In the conditions: Device platforms: select which devices you want the policy to apply to. In my case i will select windows and MacOS  Client apps: check all boxes except Browser, which will block everything except the browser. Here’s the magic: In the Filter for devices, you can ...
Read more »