Question
You have a Microsoft Entra tenant that has user consent for applications disabled.
You register an application named App1 that requests the following Microsoft Graph delegated permissions:
- User.Read
- Mail.Read
You need to configure tenant permissions to meet the following requirements:
- Enable users to grant consent for low-risk permissions without administrator interaction.
- Ensure that applications requesting higher-privilege permissions require administrator approval.
What should you do?
- A. Grant tenant-wide admin consent to App1.
- B. Configure application assignments for App1.
- C. Configure Privileged Identity Management (PIM) role assignments.
- D. Create an app consent policy. Correct
Explanation
An app consent policy governs which permissions users may consent to, so users can consent to permissions classified as low impact while anything else still needs an administrator. Tenant-wide admin consent only approves App1 on behalf of the organization and does not let users consent to anything themselves. Application assignments control who can use an app, and apps that require assignment actually need administrator consent. PIM manages privileged role activation and has no effect on application consent.
