'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Restrict Third-Party App Access in Microsoft Entra ID
Question details
Administrators need to prevent users from signing into unapproved third-party applications or adding enterprise applications without prior consent.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Securing enterprise identity environments and managing application access.
- Observed behavior
- Administrators want to implement strict access controls and consent requirements for all non-approved cloud applications.
Ensure you have the necessary administrative privileges, such as Conditional Access Administrator or Global Administrator, in Microsoft Entra ID before modifying access policies.
Configure Conditional Access Policies and Consent Settings
Set up policies to block unauthorized cloud apps and require admin consent for enterprise applications.
Microsoft Entra ID allows administrators to govern third-party application usage by combining Conditional Access policies with user consent settings. Testing these rules with a pilot group is crucial to prevent locking users out of essential daily services.
Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
Navigate to Identity > Applications > Enterprise applications > Consent and permissions. Select 'Do not allow user consent' to force admin approval before any user can add a new third-party app.
Go to Protection > Conditional Access > Policies and select 'New policy'. Name the policy to reflect its purpose, such as 'Block Unapproved Third-Party Apps'.
Under 'Target resources', select 'Cloud apps', choose 'Include', and specify 'All cloud apps'. Under 'Exclude', add your organization's approved and essential applications to ensure they continue functioning.
Under 'Access controls' > 'Grant', select 'Block access'. Set the policy state to 'Report-only' for testing with a pilot group, then switch to 'On' once verified.
Manage Your IT Documentation Effectively with WPS Office
While securing your Microsoft Entra ID environment, managing IT policies and documentation shouldn't add to your overhead. WPS Office provides a lightweight, highly compatible, and free alternative to Microsoft Office for all your administrative documentation needs.
- 1. Download WPS Office: Install the free WPS Office suite on your admin workstation.
- 2. Create IT Policies: Open WPS Writer to draft your Conditional Access and app consent policies.
- 3. Export as PDF: Use the built-in PDF tool to export your policies for secure distribution to stakeholders.
Frequently Asked Questions
What happens if I block all cloud apps in Conditional Access?
If you block all cloud apps without excluding critical services (like Microsoft Azure Management), you risk locking all users and administrators out of your environment. Always use Report-only mode first.
How do I review applications that users have requested access to?
Administrators can review admin consent requests by navigating to Identity > Applications > Enterprise applications > Admin consent requests in the Microsoft Entra admin center.
Can I restrict third-party app access for specific groups only?
Yes. When creating your Conditional Access policy, you can specify exactly which user groups the policy applies to under the 'Users' assignment section, allowing for granular control.
