App Consent Policy Evaluation Flow

Administrators control how apps get permission to access resources through consent policies. Using the Azure AD portal or Microsoft Graph, admins can set rules that determine who can consent to an app. For example, an admin can block all user consent and require admin consent for every app, or they can allow users to consent only to apps from verified publishers or for specific low-risk permissions. This policy layer acts as a gatekeeper, ensuring only trusted apps with appropriate permissions are granted access.