Users Can Consent To Apps Accessing Company Data On Their Behalf

01 Sign in to Azure Management Console.

02 Navigate to Microsoft Entra ID blade at https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview.

03 In the navigation panel, select Users.

04 Under All users, select User settings to access Microsoft Entra ID user configuration settings.

05 On the User settings configuration page, under Enterprise applications, click Manage how end users launch and view their applications.

06 On the Enterprise applications panel, check the Users can consent to apps accessing company data on their behalf setting configuration. If this setting is set to Yes, the "Users can consent to apps accessing company data on their behalf" feature is enabled, therefore all Microsoft Entra ID users can consent to third-party applications.

07 Repeat steps no. 3 – 6 for each Microsoft Entra ID that you want to examine.

01 Open an elevated Windows PowerShell command prompt (i.e. run PowerShell as an administrator) and run Install-Module MSOnline command to install MSOnline PowerShell module for Microsoft Entra ID:

Install-Module MSOnline

02 Run Connect-MsolService PowerShell command to connect to your Microsoft Entra ID environment. Once the command request is made you should be prompted for your Microsoft Entra ID credentials. To connect to a specific environment of Microsoft Entra ID, use -AzureEnvironment parameter, as shown in the example above (replace the highlighted parameter value with your own Microsoft Entra ID environment name):

Connect-MsolService -AzureEnvironment "<ad-environment-name>"

03 Run Get-MsolCompanyInformation PowerShell command with custom query filters to identify if the current Microsoft Entra ID account is configured to allow non-administrator users to consent to applications:

Get-MsolCompanyInformation | fl UsersPermissionToUserConsentToAppEnabled

04 The command output should return the "Users can consent to apps accessing company data on their behalf" feature status (True for enabled, False for disabled):

UsersPermissionToUserConsentToAppEnabled : True 
-----------------------------------------------

05 Repeat steps no. 1 - 4 for each Microsoft Entra ID that you want to examine.

01 Sign in to Azure Management Console.

02 Navigate to Microsoft Entra ID blade at https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview.

03 In the navigation panel, select Users.

04 Under All users, select User settings to access Microsoft Entra ID user configuration settings.

05 On the User settings configuration page, under Enterprise applications, click Manage how end users launch and view their applications.

06 On the Enterprise applications panel, select No next to Users can consent to apps accessing company data on their behalf setting to disable all Microsoft Entra ID users' ability to consent to applications that require access to their cloud user data, such as directory user profile or Office 365 email address.

07 Click Save to apply the configuration changes. If the request is successful, the following message should be displayed: "Successfully updated user settings".

08 Repeat steps no. 3 – 7 for each Microsoft Entra ID that you want to reconfigure to enforce administrator consent for using third-party applications.

01 Open an elevated Windows PowerShell command prompt (i.e. run PowerShell as an administrator) and run Install-Module MSOnline command to install MSOnline PowerShell module for Microsoft Entra ID:

Install-Module MSOnline

02 Run Connect-MsolService PowerShell command to connect to your Microsoft Entra ID environment. Once the command request is made you should be prompted for your Microsoft Entra ID credentials. To connect to a specific environment of Microsoft Entra ID, use -AzureEnvironment parameter, as shown in the example above (replace the highlighted parameter value with your own Microsoft Entra ID environment name):

Connect-MsolService -AzureEnvironment "<ad-environment-name>"

03 Run Set-MsolCompanySettings PowerShell command (using MSOnline module) with -UsersPermissionToUserConsentToAppEnabled parameter set to $false to disable "Users can consent to apps accessing company data on their behalf" feature and enforce Microsoft Entra ID administrators to consent to third-party multi-tenant applications before users may use them (if the request is successful, the command does not produce an output):

Set-MsolCompanySettings -UsersPermissionToUserConsentToAppEnabled:$false

04 Repeat steps no. 1 - 3 for each Microsoft Entra ID that you want to reconfigure in order to enforce Microsoft Entra ID administrator consent for using applications.