App consent policy built into Entra that lets users consent only to low-impact permissions, and only for apps registered in the tenant or from verified publishers.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains microsoft-user-default-low in context, with comparison tables and the common traps.
Terms in this definition
- App consent policy
Set of include and exclude conditions deciding which permissions users, or holders of custom roles, are allowed to consent to; microsoft-user-default-low is one built-in policy.
- AGDLP
Nesting pattern: users go into global groups, which go into domain local groups, which receive the permissions. AGUDLP adds universal groups for forests with several domains.
- organization
VCF Automation's top-level tenant, completely isolated, owning separate users, networks and resources. Three kinds exist: All Apps, VM Apps and Provider Consumption.
Related terms
- User.Read
Lets an app read the profile of whoever is signed in. This low-impact delegated Graph permission is included automatically in new app registrations, and microsoft-user-default-low typically allows users to consent to it.