Admin consent
In Microsoft Entra ID, admin consent is an authorized administrator's approval of permissions requested by an application.
What the administrator approves
An administrator can approve delegated access for users, including across an organization. They can also approve application permissions, which let an app work without a signed-in user. The role needed to approve the request depends on the permissions involved.
With delegated permissions, the app acts for a signed-in user. Both the grant and the user’s own access limit what it can do. Application permissions need a different review: what can the app reach on its own?
Match the permissions to the job
A reporting integration for one department may ask for application access to a much larger collection of data. Before approving it, ask the owner why it needs that access and whether a narrower design would work. An overbroad request is not automatically malicious, but it needs an explanation.
Check the app identifier, publisher, permission names, permission type, and resources covered. Organization-wide consent does not necessarily let every user sign in to the app; user assignment can still restrict that.
After approval, compare the saved grant with the request you reviewed. Keep the permission type with the name in the record: delegated consent and app-only consent authorize different access.