A company wants to reduce the risk of malicious applications attempting to trick users into granting them access to its data. What would you recommend for the company to set up?

Question

Exhibit

Options

• AAzure AD Admin consent for all apps
• BAzure AD User consent for apps from verified publishers
• CAzure AD No user consent
• DAzure Policy
• EAzure AD Custom user consent

• B
  78% (21)
• C
  7% (2)
• D
  4% (1)
• E
  11% (3)

Explanation

Microsoft identity platform enables the third-party applications to use the resources on behalf of the users. Users must grant their rights to the resources by providing consent to the app. The app should be registered with Azure AD, and tenant admins should define the organization Consent and Permissions for the Enterprise Applications. To do that, from the Azure AD main panel, you select the Enterprise Applications under the Manage section. Then, on the Enterprise Application screen (Number 1), select the Consent and permissions item under the Security section (Number 2). On the new Consent and permissions screen (Number 1) under the first tab - User consent settings (Number 2), you can select one of the three user consent options: - Do not allow user consent (Number 3) - admin’s consent would be required for all the registered - Allow user consent for apps from verified publishers, for selected permissions (Number 4) - admin should define the "low impact" permissions that user can consent to for the apps from the verified publisher or your organization. To define the “low impact” permissions, you click on the "Select permissions to classify as low impact" link (Number 5) or select the second tab - "Permissions classifications" (Number 7). - Allow user consent for apps (Number 6) - all users can consent for the app’s access to the organization’s data. Following the Microsoft recommendations, you need to advise the company to set up the "Allow user consent for apps from verified publishers…" option as the tool against malicious their-party https://docs.microsoft.com/en-us/azure/active-directory/develop/application-consent-experience https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user- consent?tabs=azure-portal https://docs.microsoft.com/en-us/azure/active-directory/develop/consent-framework

No community discussion yet for this question.