Manage app consent policies for group owners

App consent policies are a way to manage the permissions that apps have to access data in your organization. They're used to control what apps users can consent to and to ensure that apps meet certain criteria before they can access data. These policies help organizations maintain control over their data and ensure that it's being accessed only by trusted apps.

In this article, you learn how to manage built-in and custom app consent policies to control when group owner consent can be granted.

With Microsoft Graph PowerShell, you can view and manage group owner consent policies.

A group owner consent policy consists of zero or more "include" condition sets and zero or more "exclude" condition sets. For an event to be considered in a group owner consent policy, the "include" condition set must not match any "exclude" condition set.

Each condition set consists of several conditions. For an event to match a condition set, all conditions in the condition set must be met.

Group owner consent policies where the ID begins with "microsoft-" are built-in policies. For example, the microsoft-pre-approval-apps-for-group group owner consent policy describes the conditions under which the group owners are allowed to grant consent to applications from the preapproved list by the admin to access data for the groups they own. Built-in policies can be used in custom directory roles and to configure user consent settings, but can't be edited or deleted.

Prerequisites

• A user or service with one of the following roles:
  • Privileged Role Administrator
  • A custom role with the necessary permissions to manage group owner consent policies
  • The Microsoft Graph app role (application permission) Policy.ReadWrite.PermissionGrant (when connecting as an app or a service)
• To allow group owner consent subject to app consent policies, the group owner consent setting must be disabled. Once disabled, your current policy is read from the app consent policy. To learn how to disable group owner consent, see Disable group owner consent setting

To manage group owner consent policies for applications with Microsoft Graph PowerShell, connect to Microsoft Graph PowerShell and sign in with one of the roles listed in the prerequisites section. You also need to consent to the Policy.ReadWrite.PermissionGrant permission.

# change the profile to beta by using the `Select-MgProfile` command
Select-MgProfile -Name "beta"

Connect-MgGraph -Environment China -ClientId 'YOUR_CLIENT_ID' -TenantId 'YOUR_TENANT_ID' -Scopes "Policy.ReadWrite.PermissionGrant"

Retrieve the current value for the group owner consent policy using PowerShell

Learn how to verify if your group owner consent setting has been authorized in other ways.

1. Retrieve the current value for the group owner consent setting

     Get-MgPolicyAuthorizationPolicy | select -ExpandProperty DefaultUserRolePermissions | ft PermissionGrantPoliciesAssigned
   

   If ManagePermissionGrantPoliciesForOwnedResource is returned in PermissionGrantPoliciesAssigned, your group owner consent setting might have been authorized in other ways.

2. Check if the policy is scoped to group.

      Get-MgPolicyPermissionGrantPolicy -PermissionGrantPolicyId {"microsoft-all-application-permissions-for-group"} | Select -ExpandProperty AdditionalProperties
   

If ResourceScopeType == group, your group owner consent setting has been authorized in other ways. In addition, if the app consent policy for groups has been assigned microsoft-pre-approval-apps-for-group, it means the preapproval feature is enabled for your tenant.

List existing group owner consent policies using PowerShell

It's a good idea to start by getting familiar with the existing group owner consent policies in your organization:

1. List all group owner consent policies:

   Get-MgPolicyPermissionGrantPolicy | ft Id, DisplayName, Description
   

2. View the "include" condition sets of a policy:

   Get-MgPolicyPermissionGrantPolicyInclude -PermissionGrantPolicyId {"microsoft-all-application-permissions-for-group"} | fl
   

3. View the "exclude" condition sets:

   Get-MgPolicyPermissionGrantPolicyExclude -PermissionGrantPolicyId {"microsoft-all-application-permissions-for-group"} | fl
   

Create a custom group owner consent policy using PowerShell

Follow these steps to create a custom group owner consent policy:

1. Create a new empty group owner consent policy.

   New-MgPolicyPermissionGrantPolicy `
       -Id "my-custom-app-consent-policy-for-group" `
       -DisplayName "My first custom app consent policy for group" `
       -Description "This is a sample custom app consent policy for group." `
       -AdditionalProperties @{includeAllPreApprovedApplications = $false; resourceScopeType = "group"}
   

2. Add "include" condition sets.

   # Include delegated permissions classified "low", for apps from verified publishers
   New-MgPolicyPermissionGrantPolicyInclude `
       -PermissionGrantPolicyId "my-custom-app-consent-policy-for-group" `
       -PermissionType "delegated" `
       -PermissionClassification "low" `
       -ClientApplicationsFromVerifiedPublisherOnly
   

   Repeat this step to add more "include" condition sets.

3. Optionally, add "exclude" condition sets.

   # Retrieve the service principal for the Azure Management API
   $azureApi = Get-MgServicePrincipal -Filter "servicePrincipalNames/any(n:n eq 'https://management.chinacloudapi.cn/')"
   
   # Exclude delegated permissions for the Azure Management API
   New-MgPolicyPermissionGrantPolicyExclude `
       -PermissionGrantPolicyId "my-custom-app-consent-policy-for-group" `
       -PermissionType "delegated" `
       -ResourceApplication $azureApi.AppId
   

   Repeat this step to add more "exclude" condition sets.

Once the app consent policy for group has been created, you can allow group owners consent subject to this policy.

Delete a custom group owner consent policy using PowerShell

1. The following shows how you can delete a custom group owner consent policy.

   Remove-MgPolicyPermissionGrantPolicy -PermissionGrantPolicyId "my-custom-app-consent-policy-for-group"
   

Supported conditions

The following table provides the list of supported conditions for group owner consent policies.

To get help or find answers to your questions:

• Microsoft Entra ID on Microsoft Q&A