Enforce Administrators to Provide Consent for Apps Before Use

01 Sign in to Azure Management Console.

02 Navigate to Azure Active Directory blade at Azure Portal.

03 In the navigation panel, select Users.

04 Under All users, select User settings to access Azure Active Directory user configuration settings.

05 On the User settings configuration page, under Enterprise applications, click Manage how end users launch and view their applications.

06 On the Enterprise applications panel, check the Users can consent to apps accessing company data on their behalf setting configuration. If this setting is set to Yes, the "Users can consent to apps accessing company data on their behalf" feature is enabled, therefore all Azure Active Directory (AD) users can consent to third-party applications.

07 Repeat steps no. 3 – 6 for each Microsoft Azure Active Directory that you want to examine.

01 Open an elevated Windows PowerShell command prompt (i.e. run PowerShell as an administrator) and run Install-Module MSOnline command to install MSOnline PowerShell module for Azure Active Directory:

Install-Module MSOnline

02 Run Connect-MsolService PowerShell command to connect to your Azure Active Directory (AD) environment. Once the command request is made you should be prompted for your AD credentials. To connect to a specific environment of Active Directory, use -AzureEnvironment parameter, as shown in the example above (replace the highlighted parameter value with your own AD environment name):

Connect-MsolService -AzureEnvironment "<ad-environment-name>"

03 Run Get-MsolCompanyInformation PowerShell command with custom query filters to identify if the current Azure Active Directory account is configured to allow non-administrator users to consent to applications:

Get-MsolCompanyInformation | fl UsersPermissionToUserConsentToAppEnabled

04 The command output should return the "Users can consent to apps accessing company data on their behalf" feature status (True for enabled, False for disabled):

UsersPermissionToUserConsentToAppEnabled : True
-----------------------------------------------

05 Repeat steps no. 1 - 4 for each Microsoft Azure Active Directory that you want to examine.

01 Sign in to Azure Management Console.

02 Navigate to Azure Active Directory (AD) blade at Azure Portal.

03 In the navigation panel, select Users.

04 Under All users, select User settings to access Azure Active Directory user configuration settings.

05 On the User settings configuration page, under Enterprise applications, click Manage how end users launch and view their applications.

06 On the Enterprise applications panel, select No next to Users can consent to apps accessing company data on their behalf setting to disable all Active Directory users' ability to consent to applications that require access to their cloud user data, such as directory user profile or Office 365 email address.

07 Click Save to apply the configuration changes. If the request is successful, the following message should be displayed: "Successfully updated user settings".

08 CRepeat steps no. 3 – 7 for each Active Directory (AD) that you want to reconfigure to enforce administrator consent for using third-party applications.

01 Open an elevated Windows PowerShell command prompt (i.e. run PowerShell as an administrator) and run Install-Module MSOnline command to install MSOnline PowerShell module for Azure Active Directory:

Install-Module MSOnline

02 Run Connect-MsolService PowerShell command to connect to your Azure Active Directory (AD) environment. Once the command request is made you should be prompted for your AD credentials. To connect to a specific environment of Active Directory, use -AzureEnvironment parameter, as shown in the example above (replace the highlighted parameter value with your own AD environment name):

Connect-MsolService -AzureEnvironment "<ad-environment-name>"

03 The command output should return the "Users can consent to apps accessing company data on their behalf" feature status (True for enabled, False for disabled):

Set-MsolCompanySettings -UsersPermissionToUserConsentToAppEnabled:$false

04 Repeat steps no. 1 - 3 for each Microsoft Azure Active Directory that you want to reconfigure in order to enforce AD administrator consent for using applications.