Are there any drawbacks in bypassing consent?

Question

I'm playing around with Graph API and delegated permissions. In all articles I've read so far, there is a need for consent handling, where the user needs to act in order to allow the app to act as him.

But... the whole consent experience is bypassable, right? If the user is redirected to a browser, I can't see technical reasons this couldn't all be dealt directly by the application (although I can imagine legal/regulatory reasons). But, surprisingly, no articles mention this, and maybe for a good reason.

Am I missing something? Are there any drawbacks in getting this route if my users really don't want to manually consent to anything?

Answer 1

Personally, I would lock down automatic consents as much as possible:

https://www.linkedin.com/pulse/why-you-should-really-care-mitigating-illicit-consent-tatu-sepp%C3%A4l%C3%A4/?trk=pulse-article_more-articles_related-content-card

You can implement a consent workflow to allow trusted apps and trusted perms:

https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow

I get your what you are asking, but I think a balance is needed here and teaching users to be aware of the apps they are using and understanding what they are allowing is a good thing and - along with the consent workflow - also protects your org.