Cloud App Governance and App Consent

Cloud App Governance refers to the processes and tools used to monitor, control, and manage the use of cloud applications within an organization. It ensures that apps comply with security policies and that data access is appropriate. App consent is the mechanism by which users or administrators grant permissions to applications to access resources (e.g., Microsoft Graph, SharePoint, email). The SC-900 exam focuses on consent types, permission models, and the tools used to govern apps in Azure AD and Microsoft 365.

Applications often request permissions to access sensitive data such as user profiles, emails, files, and calendars. Without proper consent controls, users can grant excessive permissions to malicious apps, leading to data breaches. Microsoft provides a consent framework that includes user consent, admin consent, and delegated vs. application permissions. Understanding this framework is essential for securing an organization's data.

Microsoft Cloud App Security (now part of Microsoft 365 Defender) provides visibility into cloud app usage, data loss prevention, and threat detection. It uses the Cloud App Catalog, which contains over 16,000 cloud apps rated on risk factors such as security, compliance, and legal. Key features: - Cloud Discovery: Analyzes traffic logs to identify shadow IT (apps not sanctioned by IT). - App governance add-on: Extends MCAS with policies for app permissions, consent, and activity monitoring. - Conditional Access App Control: Enforces policies like session monitoring and block actions for apps.

App governance is a Microsoft 365 security feature that focuses on managing app permissions and consent. It provides: - App permission policies: Automatically revoke or restrict apps based on behavior (e.g., high data access, unusual activity). - Consent policies: Define which permissions users can consent to and which require admin approval. - Alerts and notifications: Notify admins when apps request excessive permissions or exhibit suspicious behavior.

In the Azure portal, navigate to Azure Active Directory > Enterprise applications > Consent and permissions. Here you can: - User consent settings: Choose whether to allow user consent for apps from verified publishers or all apps, or block user consent entirely. - Admin consent settings: Grant admin consent for specific apps or permissions. - Permission classification: Classify permissions as low, medium, or high impact. User consent can be allowed only for low-impact permissions.

You can use the Azure AD PowerShell module (AzureAD) to manage consent. Example commands:

# Connect to Azure AD
Connect-AzureAD

# Get all OAuth2 permission grants
Get-AzureADOAuth2PermissionGrant

# Revoke a consent grant
Remove-AzureADOAuth2PermissionGrant -ObjectId "<grant-id>"

Azure AD audit logs record all consent operations. You can view logs in the Azure portal under Azure Active Directory > Audit logs. Filter by activity "Consent to application" or "Add OAuth2PermissionGrant". Microsoft 365 Defender also provides alerts for risky consent.

Conditional Access policies can be applied to cloud apps, including those that require consent. For example, you can require multi-factor authentication (MFA) for accessing an app that has been granted consent. However, consent itself is not governed by Conditional Access; it is a separate process that occurs before token issuance.

In a large enterprise with thousands of users, managing app consent is critical. For example, a company uses Salesforce and needs to integrate with Microsoft Teams. The Salesforce app requests permissions to read user profiles and send messages on behalf of users. The IT admin decides to grant admin consent for this app to avoid users being prompted and to ensure compliance. They use Azure AD to grant tenant-wide admin consent, which requires Global Admin or Privileged Role Admin rights. The admin also configures a Conditional Access policy to require MFA for accessing Salesforce.

Another scenario: A marketing department starts using a new project management app without IT approval. This is shadow IT. Using Microsoft Cloud App Security (MCAS), the security team runs Cloud Discovery to identify the app. The app has a risk score of 8 (medium risk). The team decides to sanction the app but restrict its permissions. They use app governance to create a policy that alerts if the app accesses more than 1000 emails per hour. They also block user consent for high-risk permissions, forcing users to request admin approval for any app that needs access to sensitive data.

A common misconfiguration is allowing user consent for all apps. This leads to users granting permissions to malicious apps that exfiltrate data. For instance, a phishing campaign tricks users into consenting to an app that requests 'Mail.ReadWrite' and 'Mail.Send' permissions. The app then reads and sends emails from the user's mailbox, spreading malware or stealing sensitive information. To prevent this, the IT admin should block user consent entirely and require admin approval for all apps. They can also use permission classification to allow user consent only for low-impact permissions like 'profile' and 'email'. Regularly reviewing app permissions using the Azure AD 'Review permissions' feature helps identify and revoke excessive grants. Performance considerations: Azure AD can handle millions of consent grants, but audit logs can grow quickly. Use retention policies to manage log storage. When misconfigured, users may experience consent prompts that block productivity, or worse, data breaches occur. In production, deploy app governance policies to automatically revoke consent for apps that show anomalous behavior, such as sudden high-volume data access or access from unusual locations.