Rules/ID-005.user-consent-restricted.psd1

@{
    Id          = 'ID-005'
    Title       = 'User consent for applications is restricted'
    Area        = 'AuthorizationPolicy'
    Severity    = 'Medium'
    References  = @(
        'CIS Microsoft 365 Foundations Benchmark (user consent to apps)'
        'https://learn.microsoft.com/entra/identity/enterprise-apps/configure-user-consent'
    )
    Rationale   = 'Unrestricted user consent is the primary vector for illicit consent-grant (OAuth phishing) attacks - a malicious app gets durable API access without stealing a password.'
    Remediation = 'Restrict user consent to verified publishers and low-impact permissions, or disable it and use admin consent workflow.'
    Test        = {
        param($Snapshot)
        $authPolicy = $Snapshot.AuthorizationPolicy.authorizationPolicy
        if (-not $authPolicy -or -not $authPolicy.PSObject.Properties['defaultUserRolePermissions'] -or -not $authPolicy.defaultUserRolePermissions) {
            return New-TLRuleResult -Status Manual -Evidence 'defaultUserRolePermissions not present in the snapshot.'
        }
        $grantPolicies = @($authPolicy.defaultUserRolePermissions.permissionGrantPoliciesAssigned)
        $legacy = @($grantPolicies | Where-Object { $_ -match 'microsoft-user-default-legacy' })
        if ($legacy.Count -gt 0) {
            New-TLRuleResult -Status Fail -Evidence 'Users may consent to any application for any permission (microsoft-user-default-legacy).'
        }
        else {
            New-TLRuleResult -Status Pass -Evidence ("User consent policy: {0}" -f $(if (@($grantPolicies).Count -gt 0) { $grantPolicies -join ', ' } else { 'consent disabled' }))
        }
    }
}