Skip to content

Update manage-app-consent-policies.md #1941

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sachinatraj wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update manage-app-consent-policies.md #1941

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions docs/identity/enterprise-apps/manage-app-consent-policies.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,10 @@ An additional policy is enabled by default is the **microsoft-user-allow-default
- Android-Mail (application ID:2cee05de-2b8f-45a2-8289-2a06ca32c4c8)
- Thunderbird (application ID:9e5f94bc-e8a4-4e73-b8be-63364c29d753)

> [!Note]
>The Mail client policy (microsoft-user-allow-default-consent-apps) allows end users to consent only to a limited set of delegated mail-related permissions for specific mail client applications.
Therefore, even when this policy is enabled, administrator consent may still be required if an application requests permissions that are outside the scope of the Mail client policy.
Comment on lines +72 to +73
Copy link

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The admonition formatting is broken: line 72 is missing a space after > and line 73 isn’t prefixed with > at all, so the second sentence renders outside the Note block. Prefix each content line with > so the entire note is included.

Suggested change
>The Mail client policy (microsoft-user-allow-default-consent-apps) allows end users to consent only to a limited set of delegated mail-related permissions for specific mail client applications.
Therefore, even when this policy is enabled, administrator consent may still be required if an application requests permissions that are outside the scope of the Mail client policy.
> The Mail client policy (microsoft-user-allow-default-consent-apps) allows end users to consent only to a limited set of delegated mail-related permissions for specific mail client applications.
> Therefore, even when this policy is enabled, administrator consent may still be required if an application requests permissions that are outside the scope of the Mail client policy.

Copilot uses AI. Check for mistakes.
Comment on lines +72 to +73
Copy link

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style tweaks for consistency with Microsoft Writing Style Guide: use "might" (not "may") for possibility, and format the policy ID microsoft-user-allow-default-consent-apps as code (backticks) since it’s an identifier.

Suggested change
>The Mail client policy (microsoft-user-allow-default-consent-apps) allows end users to consent only to a limited set of delegated mail-related permissions for specific mail client applications.
Therefore, even when this policy is enabled, administrator consent may still be required if an application requests permissions that are outside the scope of the Mail client policy.
>The Mail client policy (`microsoft-user-allow-default-consent-apps`) allows end users to consent only to a limited set of delegated mail-related permissions for specific mail client applications.
Therefore, even when this policy is enabled, administrator consent might still be required if an application requests permissions that are outside the scope of the Mail client policy.

Copilot uses AI. Check for mistakes.

## Multiple policies

A user can have more than one policy that allows them to give consent. Each policy is evaluated separately (as in, an exclusion from one policy does not affect inclusions of another policy) and the user only needs one policy to approve to be allowed to consent for a specific event. For example, an application admin can consent to everything a regular user can (thanks to the default policy applied to all users), and they also have broader permissions through the microsoft-application-admin policy, which lets them approve requests for any API permission—except Microsoft Graph app roles.
Expand Down