Microsoft Entra ID
SecurityProtect against consent phishing
In brief
The documentation explains that tenant administrators cannot reverse Microsoft disablement by setting `accountEnabled` to `true` or reactivating the app registration. It also provides support guidance for application publishers and users.
What Entra admins need to know
Avoid attempting unsupported reactivation settings; contact the publisher or Microsoft Support as appropriate.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Review and use the guidance for defending against illicit consent grants. The guidance includes auditing permissions and consent for disabled and suspicious applications found during review.
- Implement best practices for hardening against consent phishing, described in the following section.
If you believe Microsoft disabled an application in error
Tenant administrators can't reverse Microsoft disablement by setting the service principal's accountEnabled property to true or by reactivating the app registration (isDisabled=false). This restriction also applies to administrators in the application's home tenant.
If your organization publishes the application, work with an administrator in its home tenant to contact Microsoft Support through the general Microsoft Entra support options. Explain why you believe the disablement is an error, and include the application (client) ID, home tenant ID, disabledByMicrosoftStatus value, and relevant investigation findings. Opening a support request doesn't guarantee reactivation.
If your organization uses an application published by another organization, contact the publisher about the disablement and continue investigating the application's activity in your tenant. You can also use the general support options to get help with the impact on your tenant. Changing your tenant's sign-in setting doesn't remove the Microsoft disablement.
Best practices for hardening against consent phishing attacks
Administrators should be in control of application use by providing the right insights and capabilities to control how applications are allowed and used within organizations. While attackers never rest, there are steps organizations can take to improve the security posture. Some best practices to follow include:
@@ -2,7 +2,8 @@ title: Protect against consent phishing description: Learn ways of mitigating against application-based consent phishing attacks using Microsoft Entra ID. ms.topic: concept-article-ms.date: 12/11/2023+ms.date: 10/20/2026+ai-usage: ai-assisted ms.custom: template-concept, enterprise-apps-article ms.reviewer: tilarso @@ -41,6 +42,14 @@ If a Microsoft disabled application impacts the organization, the organization s 1. Review and use the [guidance for defending against illicit consent grants](/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants). The guidance includes auditing permissions and consent for disabled and suspicious applications found during review. 1. Implement best practices for hardening against consent phishing, described in the following section. +### If you believe Microsoft disabled an application in error++Tenant administrators can't reverse Microsoft disablement by setting the service principal's `accountEnabled` property to `true` or by reactivating the app registration (`isDisabled=false`). This restriction also applies to administrators in the application's home tenant.++If your organization publishes the application, work with an administrator in its home tenant to contact Microsoft Support through the [general Microsoft Entra support options](~/fundamentals/how-to-get-support.md#open-a-support-request). Explain why you believe the disablement is an error, and include the application (client) ID, home tenant ID, `disabledByMicrosoftStatus` value, and relevant investigation findings. Opening a support request doesn't guarantee reactivation.++If your organization uses an application published by another organization, contact the publisher about the disablement and continue investigating the application's activity in your tenant. You can also use the general support options to get help with the impact on your tenant. Changing your tenant's sign-in setting doesn't remove the Microsoft disablement.+ ## Best practices for hardening against consent phishing attacks Administrators should be in control of application use by providing the right insights and capabilities to control how applications are allowed and used within organizations. While attackers never rest, there are steps organizations can take to improve the security posture. Some best practices to follow include: