4.2.3. App Assignment, Roles, and Consent
💡 First Principle: Two different gates control app access: assignment decides who may use the app at all, and consent decides what the app may do with directory data. Admins guard both — the first with assignment requirements, the second with consent policy — because users will otherwise click "Accept" on anything.
Assignment. The service principal's "User assignment required?" property is the master switch: off (default) means any authenticated user can sign in (the app decides internally); on means only assigned users/groups get tokens — the enforcement point for licensing limits and need-to-know apps. Assign users or groups (nested groups don't flow to app role assignment — use flat groups); each assignment can carry an app role (roles the app defined in its manifest — e.g., Admin, Reader) delivered in the token's roles claim for the app's internal authorization. Visibility is separate: hidden apps still work; unassigned apps still show errors on launch — tune both.
Consent is OAuth's permission grant made governable. User consent: by default users may consent to low-risk delegated permissions for verified apps — most tenants tighten this (disable entirely, or allow only for verified publishers + selected low-impact permissions). Admin consent: grants a permission for all users (the banner "consent on behalf of your organization") and is mandatory for application permissions and high-privilege delegated ones. The admin consent workflow threads the needle when user consent is disabled: blocked users click "Request approval," designated reviewers approve/deny in the portal — governed self-service instead of shadow IT or admin fatigue.
Review standing grants under the service principal's Permissions blade — attackers plant persistence as consented apps (2.3.3's post-compromise checklist), and 4.4.3 automates the watching.
⚠️ Exam Trap: "Users must not consent to any application, but must be able to request access with approval by the security team" is the admin consent workflow verbatim — disable user consent + enable the workflow with named reviewers. Disabling consent alone (no workflow) is the distractor that creates helpdesk chaos.
Reflection Question: Why is "User assignment required = No" defensible for a company-wide announcement portal but dangerous for a per-seat-licensed HR system — name both the security and the commercial consequence.
