The admin consent workflow lets a user request an app they are not allowed to consent to. Designated reviewers get an email, act on the request, and the user is told the result. Only a Global Administrator can turn it on, and being named a reviewer does not grant extra privileges.
Why turn it on
If you restrict user consent, people still need apps. Without a request path they will find workarounds or pile onto your help desk. The workflow gives a record: who asked, for what, and who decided.
Enabling it
In the Entra admin center, go to Enterprise apps, then Consent and permissions, then Admin consent settings. Under Admin consent requests, choose Yes for the option that lets users request admin consent to apps they cannot consent to.
Then set four things:
- Who can review requests: users, groups or roles.
- Email notifications to reviewers.
- Expiration reminders.
- How many days a request stays valid.
Saving can take up to an hour before the workflow is active.
Reviewer rules that matter
A reviewer must already have the permissions needed to grant admin consent for that app. Naming someone as a reviewer does not elevate them.
Reviewers can view, block or deny requests. For apps requesting Microsoft Graph application permissions, only a Global Administrator can approve. So a delegated reviewer group can clear routine requests but will need a Global Administrator for the heaviest ones.
There are some documented quirks. A removed reviewer keeps the ability to review requests made while they were a reviewer and still gets expiry reminders for them. New reviewers are not assigned to requests that existed before they were added or to expired ones.
If you turn off email notifications, requesters also stop getting emails when a request is made and reviewed.
What to ask before you approve
Reviewing is only useful with criteria. A short list works:
- Who publishes the app, and is the publisher verified? Remember what that badge does and does not prove.
- What permissions does it ask for, and are any application permissions rather than delegated?
- Is there a business owner who will keep using it?
- Is there a cheaper permission set that does the same job?
- What is the plan to remove it when the project ends?
Write the decision and the reason in the request notes, so you can answer an auditor.
Keep Global Administrator rare
Microsoft's own guidance stresses using the least privileged role and keeping Global Administrator for cases where nothing else works. Plan reviewer coverage so approvals do not depend on one person.
The Safeguard compliance and evidence automation can hold approval records alongside other access review evidence.
Quick check
Does naming someone a reviewer let them approve any app?
No. They need the permissions required to grant admin consent for that app.
Who can approve apps that ask for Graph application permissions?
Only Global Administrators.
Sources
Last reviewed: 19 October 2026.
