Managing your Azure Active Directory Consents

More and more services offer you to login using your existing Microsoft, Google, Twitter or Facebook account. This is helpful because it simplifies your password management, but you also need to be careful to avoid security risks.

Here is an example from sessionize.com:

Sessionize.com login methods

Risks

First there is the obvious security risk that if your Microsoft/Google/Twitter/Facebook account get hacked, the hacker will get access to all services where you use that account.

This doesn't necessarily have to be wrong, but if your Microsoft/Google/Twitter/Facebook account get hacked, you might in worst case not even know which services the hacker has gained access to. At least, you should have an offline list of which services you are using Microsoft/Google/Twitter/Facebook logins for.

Secondly, when you enable Microsoft/Google/Twitter/Facebook logins, you give the service consent to your information. Some services ask for consent for only very limited information (such as your email and name), but other services require consent to much higher access to your information. It is important to keep track of which consent you have given.

Now there are two different places to view and manage your consent, depending on if you are using an organization account or a personal account. I will describe both.

There's a bit of naming confusion here, because the Azure AD (Active Directory) account is also called Office365-account, Microsoft365-account, Microsoft work/school-account, and various other names. You could even have two accounts (both Azure AD account and personal Microsoft account) with the same email address. If in doubt, try both places.

To manage your consent for Azure AD, go to myapplications.microsoft.com. There you will see a list of your apps and if you click on the top upper corner of an app, you can manage your consent for that app.

Managing your Azure AD consent

This takes you to a detail window, where you can see that consent that you approved and what your Azure AD admin has approved. You can't make changes to what your Azure AD admin has approved.

Managing app consent

Important note: Your Azure AD account can be tied to multiple organizations. Click on the organizations icon at the top right corner of the screen to get a list of your organizations and be able to switch between them.

Organizations

To manage your consent for personal Microsoft accounts, go to https://account.live.com/consent/manage. You will see apps and services you have given access.

Managing Microsoft account consent

Click on any app to view and manage consent details.

Managing app consent

Conclusions

Keeping track of your consents from Azure AD accounts and personal Microsoft accounts is an important security measure. You should make it a habit to review your consents.

Related Posts