Delegated consent is permission a user grants an application to access resources on that user’s behalf, within the limits of the user’s own rights and the permissions requested. In Microsoft Entra, consent can authorize an app to perform tasks such as reading a user’s profile or accessing files. It is distinct from application permissions, which let an app act as its own identity.
Consent matters because an app with granted permissions may continue accessing data through tokens, depending on the permission and authentication setup. Attackers may abuse a malicious or compromised app, or misuse an overly broad grant, to reach cloud resources without repeatedly stealing a password. Defenders should review consent records and enterprise applications, restrict user consent where appropriate, grant only necessary permissions, and investigate unexpected grants or app activity in audit logs. If a grant is suspicious, revoke consent and assess related tokens and access.