A blue verified badge in an Entra consent prompt means Microsoft verified that the organization publishing the app is authentic. It is tied to a verified Microsoft partner account. It is not a security review of the app, a certification, or a statement that the permissions requested are reasonable.
What the badge is based on
Publisher verification uses a verified Microsoft AI Cloud Partner Program account. The developer links that account's partner ID to the app registration. Some requirements show the effort involved: the app must be registered with a work or school account, a publisher domain must be set, the domain must match the verified email domain or a DNS verified custom domain, and the person doing it must sign in with multifactor authentication.
Microsoft says verification costs developers nothing and can take minutes for those who meet the requirements.
What it does not tell you
Microsoft's own FAQ says the badge does not imply quality criteria such as certifications, compliance with standards or good practices. Other programs, such as Microsoft 365 App Certification, cover those. Verified status is one of several criteria to weigh when evaluating an app and its consent requests.
So the badge answers "who publishes this?" It does not answer "should this app have these permissions?"
Where it does real work
Admins can write user consent policies that use verified publisher status as a primary condition. That is the basis for Microsoft's recommended setting: allow user consent only for verified publishers and for low impact permissions.
Microsoft also notes that with risk based step up consent enabled, users cannot consent to most newly registered multitenant apps that are not verified, when those apps ask for more than basic sign in and profile reading. The consent screen carries a warning about an unverified publisher.
Limits worth knowing
- Publisher verification is not supported in national clouds.
- Apps registered with a personal Microsoft account cannot be verified.
- It applies mainly to multitenant apps using OAuth 2.0 and OpenID Connect.
A review habit
When a request arrives, check the badge, then look at the permission list. A verified publisher asking for read and write access to all files deserves the same question as an unknown one: why? The reverse also holds. An internal app with no badge can be fine if your own team registered it.
Use the badge to sort the queue, not to close it.
Quick check
Does a verified badge mean the app passed a security review?
No. It verifies the publisher organization. Microsoft says it does not indicate certifications or good practices.
Is verification expensive for developers?
Microsoft states there is no charge and no license required.
Sources
Last reviewed: 19 October 2026.
