Disabling user OAuth consent is the right first step — but without a way for users to legitimately request app access, you either block real work or push people toward shadow IT. The admin consent workflow solves this by giving users a structured path to request app access, while ensuring an administrator reviews and approves it before any permissions are granted.
When enabled, users who need a third-party app submit a request with context on what they need and why. Designated reviewers receive a notification, review the app's requested permissions and publisher, and approve or deny. This creates a documented record of every app granted access to your tenant, replaces invisible user-level consents with a visible governed process, and prevents malicious apps from slipping through under the guise of user productivity.
This policy is the necessary companion to disabling user consent. They should always be deployed together.
Most organisations benefit from the native admin consent workflow. Some scenarios may warrant a different approach:
In all cases, there should be a named person or team responsible for reviewing consent requests, and a defined response SLA so requests don't sit unreviewed for weeks.
After enabling this control, review these related areas: