ShadowAI Defense GitHub
← All detections
DET-MS-CA-002 Conditional Access Identity config Severity: Medium

Conditional Access — Block AI app OAuth grants for non-admin users

Conditional Access policy combined with Entra ID consent settings that prevents non-admin users from granting OAuth consent to AI-related applications, centralizing AI app approval through the admin-consent workflow.

Rule

# Microsoft Entra ID — Restrict OAuth Consent for AI Applications
#
# This control combines two configurations:
#
# Part 1: Entra ID Consent Settings
# Navigation: Entra Admin Center > Identity > Applications > Consent and permissions
#
# User consent settings:
#   - Option: 'Allow user consent for apps from verified publishers,
#     for selected permissions' (recommended)
#   - OR: 'Do not allow user consent' (strictest)
#   - Classified permissions: only allow low-risk permissions
#     (User.Read, openid, profile, email, offline_access)
#   - All other permissions require admin approval
#
# Admin consent workflow:
#   - Enable: Yes
#   - Reviewers: AI Governance team + IT Security
#   - Consent request expiry: 30 days
#   - Email notifications: enabled for new requests
#
# Part 2: Conditional Access Policy (supplementary enforcement)
# Navigation: Entra Admin Center > Protection > Conditional Access > New Policy
#
# Policy: Require Admin Consent for AI App Access
#
# Assignments:
#   - Users: All users EXCEPT:
#     - Global Administrators
#     - Application Administrators
#     - Cloud Application Administrators
#     - AI Governance team members
#     - Break-glass accounts
#   - Target resources: Select apps
#     - Condition: app registration filter where
#       app displayName contains 'AI', 'GPT', 'Claude', 'Gemini', 'Copilot'
#       OR app category in (Generative AI) via app governance tags
#
# Access controls:
#   - Grant: Block access
#   - Combined with admin-consent workflow: users see 'Request admin approval' instead of consent button
#
# Session controls:
#   - Not applicable (access is blocked until admin approves)
#
# Monitoring:
#   - Entra ID sign-in logs: filter for blocked consent attempts
#   - Admin consent request queue: review weekly
#   - Alert: email to AI Governance on each new admin-consent request for AI apps

How it works

Addresses the OAuth consent vector for Shadow AI. When employees discover a new AI tool, many will click 'Allow' on OAuth consent prompts without understanding the permissions being granted (e.g., Mail.ReadWrite, Files.ReadWrite.All). This grants the AI application persistent access to organizational data — a more serious risk than one-off copy-paste to a chat interface. By restricting user consent and routing AI app approvals through the admin-consent workflow, the organization gains a chokepoint for reviewing and approving AI applications before they access corporate data. The Conditional Access component adds defense-in-depth by blocking access to known AI apps that haven't been through the approval process.

Required data sources

  • Microsoft Entra ID P1 or higher
  • Entra ID audit logs (consent grant events)
  • Entra ID sign-in logs

Prerequisites

  • Entra ID P1+ licensed
  • Admin-consent workflow enabled and reviewers assigned
  • AI Governance team identified and assigned as consent reviewers
  • Break-glass accounts created and excluded from the policy
  • User communications explaining the admin-consent requirement for AI apps

Expected volume

Admin-consent requests: 5-20 per week initially, stabilizing to 1-5/week as the approved AI app inventory matures. Blocked sign-in attempts: 10-30/day dropping to near zero after communications.

False-positive guidance

Some legitimate enterprise tools with AI features may be blocked by the display-name filter (apps with 'AI' in their name). Maintain an allow-list of pre-approved apps. Internal applications with AI-related names will also be blocked — ensure internal app registrations are excluded or pre-approved.

Tuning steps

  1. Start with the Entra ID consent settings (Part 1) — this is the primary control.
  2. Add the Conditional Access policy (Part 2) in report-only mode for 2 weeks.
  3. Build the pre-approved AI app list from the current MCAS app inventory.
  4. Refine the app display-name filter to reduce FPs from non-AI apps with 'AI' in their name.
  5. Establish an SLA for admin-consent review (recommended: 48 hours for standard, 4 hours for urgent).
  6. Review denied consent requests monthly to identify unmet AI tool needs.

Framework mappings

  • NIST AI RMF: GOVERN-4.1, MANAGE-2.2
  • ISO/IEC 42001: 8.2, 8.4
  • NIST CSF: PR.AC-4, PR.AC-1

Related AI Controls Catalog entries