User consent
In Microsoft Entra ID, user consent is a user's approval for an application to access a protected resource on that user's behalf, where policy permits it.
What the user approves
Signing in identifies the user. Consent lets an application use the permissions being approved. In Entra, user consent grants delegated permissions. Tenant policy determines which apps and permissions a user can approve; some requests require admin consent.
A consent prompt need not appear at every sign-in. An existing user or administrator grant may already cover the request. A new permission request can need further approval. If no prompt appears, check existing grants before concluding the app has no access.
Check the request, then the grant
Compare the permission names with what the app is supposed to do. A scheduling tool asking to read unrelated business data deserves a closer look, even when the consent page belongs to the genuine identity provider. The provider can authenticate a user without vouching for the app’s business purpose.
If the request looks wrong, report the app identifier, requested permissions, and claimed purpose through your usual support channel. Those details are more useful than the app’s display name alone.
If someone already approved it, inspect the recorded grant and subsequent app activity. A grant shows what was authorized; it does not prove that the app read data. The consent phishing article follows that distinction through an investigation.