Enterprise Applications - Admin Consent Requests

Question

We recently had a pentest done and one of the recomendations was to turn on "Users can request admin consent to apps they are unable to consent to" which has resulted in "Admin Consent Requests" to start coming in.

When reviewing the requests I notice it says "If you accept, this app will get access to the specified resources for all users in your organisation. No one else will be prompted to review these permissions." so I am not keen on approving anything until I fully understand the implications of doing so.

I have a few questions that hopefully make sense:

1. Is it a case of simply reviewing what the app is requesting, agreeing it looks legitimate and is requesting to access things we would expect an app of that kind would need, before approving it.
2. Once approved, does the user get added to the "Users and groups" list of the corresponding Enterprise Application?
3. We have an application that all users in the organisation are assigned to and can access with Azure SSO. Viewing the "Admin Consent Requests" page I can see a number of people have requested admin consent for this app. Using an account that has never accessed this application before, I managed to sign in using SSO and didn't have to request an admin to allow anything - is there a simple explanation as to why some users seem to be requesting admin access when the majority of users can access said app without doing that?
4. We have receieved a request to grant admin permissions for an enterprise app which has the same name as one that already exists, however the application ID is different to the existing app. Is this a different instance of the app? (Trello is the app in question)

Thanks

Answer 1

Is it a case of simply reviewing what the app is requesting, agreeing it looks legitimate and is requesting to access things we would expect an app of that kind would need, before approving it.

See Evaluate a request for tenant-wide admin consent for some suggestions of what to look (and look out) for.

Once approved, does the user get added to the "Users and groups" list of the corresponding Enterprise Application?

No. If you want to assign the app to users or groups, that is currently a separate step you need to take. You also have the option of requiring that only assigned users able to sign in to the app, but this will not be the default for many apps that show up in the admin consent request queue.

We have an application that all users in the organisation are assigned to and can access with Azure SSO. Viewing the "Admin Consent Requests" page I can see a number of people have requested admin consent for this app. Using an account that has never accessed this application before, I managed to sign in using SSO and didn't have to request an admin to allow anything - is there a simple explanation as to why some users seem to be requesting admin access when the majority of users can access said app without doing that?

It is possible (likely) that the application is dynamically requesting additional permissions, in response to users' actions within the application. (Similar to how a mobile apps might request permission to access files on the device only once you try to use the feature of the app that requires that.) If this is the case, the admin consent request the user made will have captured the specific permissions being requested at that point in time. Granting admin consent from the pending request list ensures these dynamically requested permissions are also taken into account.

We have receieved a request to grant admin permissions for an enterprise app which has the same name as one that already exists, however the application ID is different to the existing app. Is this a different instance of the app? (Trello is the app in question)

It's impossible to say for certain based only on the display name. In general, app publishers can input any display name for their app. You should be on the lookout for malicious apps which claim they are a well-known app, but are in fact only trying to get users (or worse, administrators) to grant their app access to your organization's data. See Protecting against consent phishing. One thing in particular you should be looking for is that the publisher of the application really is who they claim they are—publisher verification can help with this.

When in doubt, do not grant admin consent, and reach out to the requesting user and/or the app publisher to get more details. Better to be safe than sorry!