Developers still need a path to request Graph scopes after user consent is disabled. Which Entra feature should the security engineer enable?
Select an answer to reveal the explanation.
Short Explanation
Turning user consent off should not leave developers stranded in a dead end. Turn on the admin consent workflow: they submit a why, a reviewer clicks yes or no, and you keep the guardrails.
Full Explanation
The admin consent workflow lets users request access to apps or permissions when they cannot consent themselves, capturing justification for designated reviewers who approve or deny. After user consent is disabled in the water-lab tenant, the security engineer should enable the admin consent workflow so developers still have a governed path to request Graph scopes without silently restoring unrestricted user consent for all publishers.
Silently re-enabling unrestricted user consent for all publishers so developers never wait on reviewers fails the security objective that motivated disabling consent. Replacing consent with Entitlement Management packages for every Graph scope in the tenant overscopes the answer; access packages are valuable for broader access governance, but the direct Entra feature for consent requests after user consent is disabled is the admin consent workflow. Publishing each developer workstation through Application Proxy to bypass consent evaluation fails by concept and does not grant Graph permissions.
Exam caveat: restricted user consent plus admin consent workflow is a paired pattern—do not disable consent without a request path if developers must ship. Operational check: enable the workflow, designate reviewers, submit a developer request with justification, approve as a reviewer, confirm the developer can use the permitted scopes, and ensure random unverified apps remain blocked.