TenantLens

1.3.2

Rules/ID-009.admin-consent-workflow.psd1

@{
    Id          = 'ID-009'
    Title       = 'The admin consent request workflow is enabled'
    Area        = 'CrossTenantAccess'
    Severity    = 'Low'
    References  = @(
        'CIS Microsoft 365 Foundations Benchmark (admin consent workflow)'
        'https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow'
    )
    Rationale   = 'With user consent restricted (ID-005) but no request workflow, blocked users work around IT with shadow accounts - the workflow routes legitimate app needs to a reviewer instead.'
    Remediation = 'Enable the admin consent workflow and assign reviewers who can approve app consent requests.'
    Test        = {
        param($Snapshot)
        $requestPolicy = $Snapshot.CrossTenantAccess.adminConsentRequestPolicy
        if (-not $requestPolicy -or -not $requestPolicy.PSObject.Properties['isEnabled']) {
            return New-TLRuleResult -Status Manual -Evidence 'Admin consent request policy not present in the snapshot.'
        }
        if ([bool]$requestPolicy.isEnabled) {
            New-TLRuleResult -Status Pass -Evidence 'Admin consent request workflow is enabled.'
        }
        else {
            New-TLRuleResult -Status Fail -Evidence 'Admin consent request workflow is disabled - users have no sanctioned path to request app approvals.'
        }
    }
}