Admin consent workflow for third-party apps
Published Feb 24, 2024
•
Updated May 1, 2026
Overview
Structured consent prevents shadow SaaS while keeping velocity for known vendors.
Workflow
- User submits business justification in form → security reviews permissions requested.
- Approver grants tenant-wide admin consent only scoped to org if app supports.
- SSO integration tracked in CMDB.
Red flags
Directory.ReadWrite.All, Mail.Send, broad Files.ReadWrite.All.
After approval
Enable user assignment if app supports—enforce least privilege.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
security-endpoint-protection
msp
+1
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
security-endpoint-protection
msp
+1
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...
security-endpoint-protection
msp
+1