App consent, PIM and Conditional Access
Identity is the main security boundary in the cloud. This lesson covers three Entra controls the exam uses together: consent, privileged roles and access policies.
App consent
When a user signs in to an app, the app asks for permissions on their behalf. Without limits, a user could grant a malicious app access to mail or files.
- User consent settings decide whether users can consent at all.
- An app consent policy lets users consent only to permissions you classify as low risk, for example selected delegated permissions from verified publishers.
- The admin consent workflow lets users request approval for anything else.
- Tenant-wide admin consent grants the permission for every user at once. It fixes one app but does not set a rule.
Privileged Identity Management
PIM gives just-in-time role access. An assignment is either eligible (must be activated) or active (always on).
| Setting | What it does |
|---|---|
| Activation maximum duration | How long one activation lasts |
| Require approval to activate | A named approver must accept the request |
| Require justification / MFA / ticket | Evidence at activation |
| Expire eligible assignments after | When the person loses the right to activate |
| Expire active assignments after | When an active assignment ends |
PIM covers Entra roles, Azure resource roles and groups (PIM for Groups). Access reviews recertify who still needs access, but they do not react to risk in real time.
Conditional Access
Conditional Access is the policy engine: assignments (users, apps, networks, conditions) plus grant or session controls.
- A policy that includes “Any network or location”, excludes a trusted location and has the grant Block access blocks sign-ins from everywhere except that location. Exclusions always win over inclusions.
- Workload identities and agent identities can be targeted by Conditional Access. Use the service principal risk condition from Microsoft Entra ID Protection to restrict identities that look compromised.
- Entra authentication for VPN and for Azure VM sign-in lets Conditional Access apply there too. Certificate authentication on a VPN gateway does not.
Guest users
External users usually need explicit roles for each service, for example the Microsoft Sentinel Responder role to assign incidents. Entra roles alone do not give access to Azure resources.
Exam traps
- Using tenant-wide admin consent when the question asks for a rule that separates low and high risk. That is a consent policy.
- Mixing up eligible expiry and active expiry. “Removed automatically after a fixed period” after activation is the activation duration.
- Choosing an access review for automatic risk response. Reviews are periodic and manual.
- Forgetting that an excluded location in a Block policy is allowed.
- Assuming PIM is free. It needs Entra ID P2 or ID Governance licensing.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. Users may consent to low-risk permissions on their own, but higher-privilege permissions need an administrator. What do you create?
Show answer
Answer: B.An app consent policy defines which permissions users may consent to. Everything outside the policy goes to the admin consent workflow.
2. A role activation must be approved by another admin, and the activated access must end automatically. Which two PIM settings do you configure?
Show answer
Answer: A.Require approval to activate adds the approver, and Activation maximum duration ends the activated session after a fixed time.
3. A workload identity is flagged high risk because of unusual sign-in activity. Access to resources must be restricted automatically. What do you create?
Show answer
Answer: C.Conditional Access can use service principal risk from ID Protection as a condition and block or restrict access without manual work.
4. Which action reduces standing privilege for administrators the most?
Show answer
Answer: A.PIM turns permanent (active) roles into eligible ones that must be activated, which removes standing access.