Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For Microsoft Entra ID, set up OAuth app governance in two connected but separate layers: an admin consent workflow that decides whether an application may receive organizational permissions, and access reviews that recertify which people should retain access. Enable the request workflow, assign reviewers who already have the necessary directory privileges, inspect every requested scope, restrict approved apps with user assignment where appropriate, and configure reviews only after Entra can represent and remove the app access path.
This guide is specific to Microsoft Entra ID. Okta, Google Workspace, and other identity providers use different menus, roles, consent models, and review capabilities.
What OAuth app approval and access reviews control
An OAuth or OpenID Connect application can ask for permission to act for a signed-in user or to access organizational data as an application. In Entra, the authorization decision is represented by consent. A user may be allowed to consent to some low-risk delegated permissions, while other permissions require an administrator to approve them for the tenant.
Access reviews answer a different question: which people should still be able to use an application that is already integrated and authorized? Approval governs the app’s permission grant; an access review recertifies user, group, or app-role access. Neither control replaces the other.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Consent governance: decides whether the application receives the requested delegated or application permissions.
- User restriction: determines whether everyone in the tenant can sign in after consent, or only assigned users and groups.
- Access review: asks reviewers to confirm or remove represented access on a recurring schedule.
A review can remove access automatically only when Entra controls, or can reliably reach, the application’s access path. If the application has no federation, provisioning, or assignment path that Entra can change, the review result requires a separate manual enforcement step.
Choose the consent policy before enabling requests
The request workflow is not itself a complete user-consent policy. First decide which users may consent without an administrator and which permission categories must be reviewed.
Common user-consent positions
| Policy position | What it allows | When it fits |
|---|---|---|
| Restricted | Users cannot consent to applications; an administrator handles requests. | High-sensitivity data, regulated environments, or tenants with little tolerance for unreviewed integrations. |
| Selected low-impact permissions | Users can consent only to explicitly permitted delegated permissions or verified low-impact categories; other requests go to administrators. | Organizations that want self-service for routine productivity tools while retaining control of data-bearing scopes. |
| Broader user consent | Users can approve a wider set of delegated permissions under the tenant’s rules. | Less restrictive environments where users are trained and application risk is actively monitored. |
The right choice depends on the data exposed, the strength of publisher verification, the organization’s incident response capability, and whether users can understand permission prompts. A workflow can route blocked requests to reviewers, but it does not make a permissive consent policy safe by itself.
Separate delegated and application permissions
Delegated permissions let an app act on behalf of a signed-in user. The app’s effective access is bounded by that user’s permissions and the granted scopes. Application permissions allow the app to access data without a signed-in user, so they can operate across organizational data and are generally more consequential. Inspect the permission type and each individual scope instead of approving an app because its name or publisher is familiar.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Prerequisites, roles, and licensing
- A Global Administrator must enable the admin consent workflow in the Microsoft Entra admin center. This is a highly privileged role; use it sparingly and protect it with the organization’s privileged-access controls.
- Designated reviewers are not automatically granted permission to approve consent. Microsoft’s warning is explicit: “Simply designating them as a reviewer doesn’t elevate their privileges.”
- Only Global Administrators can approve requests for Microsoft Graph application permissions according to the workflow documentation. Confirm current role requirements and tenant policy before assigning approval duties.
- Microsoft says enabling the workflow can take up to one hour to take effect.
- Application access reviews require licensing such as Microsoft Entra ID P2 or Microsoft Entra ID Governance, or EMS E5, according to Microsoft’s preparation guidance. Check the tenant’s current licensing and product packaging before planning deployment.
Keep the reviewer list small, use named people or groups with clear ownership, and document who is accountable for each application. Reviewer assignment is an administrative routing function; it is not a substitute for granting the underlying directory role required for the requested consent.
Enable the Microsoft Entra admin consent workflow
- Sign in to the Microsoft Entra admin center with a Global Administrator account or an account authorized by your tenant’s role policy.
- Open Entra ID > Enterprise apps > Consent and permissions > Admin consent settings.
- Under Admin consent requests, set Users can request admin consent to apps they are unable to consent to to Yes.
- Configure the reviewer users, groups, or roles. Select people who can evaluate the application and who separately possess the permissions needed to grant the requested consent.
- Turn reviewer request notifications on or off according to your operating process. Configure expiration reminders so uncompleted requests do not remain indefinitely.
- Set the request validity period. A short validity period limits the time available for an unattended request and forces the requester to resubmit when the business need is no longer current.
- Save the settings, then allow up to an hour for the workflow to become available throughout the tenant.
Reviewer-list changes have an important edge case: reviewers added later do not receive requests that were created before they were assigned. Reviewers removed from the list can retain the ability to review requests made during their designation. Reconcile pending requests when changing ownership rather than assuming the new list automatically inherits every historical item.
What happens when a user requests approval
When a user is blocked from self-consenting, Entra presents an “Approval required” prompt. The user explains why the application is needed and submits the request. Designated reviewers receive the configured notification, and Entra notifies the user when a reviewer acts.
Tell users to provide a business purpose that identifies the workflow, the data involved, the expected duration, and the people who need access. “I need this app” is not enough evidence for a tenant-wide grant. A specific explanation helps reviewers test whether each requested permission matches the stated feature.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Review a pending request in Entra
- Open the Microsoft Entra admin center and go to Entra ID > Enterprise apps > Activity > Admin consent requests.
- Open My Pending and select a request.
- Read Review permissions and consent to identify every delegated and application permission, including scopes that may expose directory, mail, files, or other organizational data.
- Read App details to establish who controls and publishes the application, whether the publisher is legitimate, and whether the application identity matches the business request.
- Read Requested by to verify the requester, department, business owner, and stated need.
- Compare the requested scopes with the exact feature the requester described. If the scope is broader than necessary, pause the decision and ask the publisher or internal owner for an explanation.
- Select Approve, Deny, or Block, and record the evidence and decision owner in the organization’s change or access-governance record.
Microsoft’s consent-management guidance states: “If you aren’t confident that you understand who controls the application and why the application is requesting the permissions, don’t grant consent.” A recognizable vendor, a verified-looking name, or many existing user grants is not, by itself, proof that a new tenant-wide consent is appropriate.
Understand the three outcomes
| Outcome | Effect | Use it when |
|---|---|---|
| Approve | Grants admin consent. Unless access is separately restricted, the application may become available to all users in the tenant. | The publisher, business need, and every requested scope are understood and acceptable. |
| Deny | Rejects the request and requires a justification. The requester can submit another request for the same application later. | The current evidence is insufficient, the need is not established, or the request should be reconsidered after changes. |
| Block | Rejects the request, requires a justification, creates a disabled service principal in the tenant, and prevents future requests for that application. | The application is unsafe, fraudulent, inappropriate for the tenant, or repeatedly requests unacceptable access. |
Microsoft documents programmatic access to consent-request resources through Microsoft Graph, but the cited review guidance says Graph cannot approve or deny consent requests. Do not design a fully automated approval path around that API.
Use a reviewer checklist for every approval
- Publisher identity: Can the organization identify and contact the application owner or publisher? Is the application name, publisher, and tenant service principal consistent?
- Business justification: What workflow requires the integration, who owns it, and why is an OAuth connection necessary?
- Permission fit: Does every requested scope correspond to a documented feature? Is a delegated scope being requested when an application permission is unnecessary?
- Data sensitivity: What mail, files, directory objects, credentials, or business records could the grant expose?
- Duration: Is the need permanent, project-based, or temporary? Set an internal expiration or review date even when the consent grant itself does not expire automatically.
- Access population: Should all users be able to sign in, or only a defined group? Plan assignment restrictions before approval.
- Operational owner: Who will respond to incidents, publisher changes, scope changes, and failed access reviews?
- Audit trail: What evidence supports the decision, who approved it, and what compensating controls apply?
Restrict who can use an approved app
Admin consent and user access are separate controls. Approving consent may allow every user in the tenant to access the application unless you require assignment. If the business case names a department, project team, or small set of administrators, configure the enterprise application so that user assignment is required and assign only the approved users or groups.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Assignment is especially important for applications that receive broad tenant-wide consent. It limits who can initiate a sign-in even though the app has already received permission. Review assignment changes as privileged events because a person who can alter application integration or assignments may expand access without changing the original consent record.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Audit existing applications and grants, not only new requests. Where licensed features are available, Microsoft recommends monitoring consent activity through Microsoft Defender for Cloud Apps or Azure Monitor workbooks. Include privileged directory roles that can change application integrations or assignments in the wider access-governance program.
Prepare an application for an effective access review
An access review has an enforceable result only when Entra represents the access path. Before creating a review, identify how users reach the application and which Entra object can be changed when a reviewer rejects access.
| Access pattern | What to review | How removal can take effect |
|---|---|---|
| Federated single sign-on with individual assignments | Users or groups assigned to the enterprise application or app role. | Removing the assignment prevents the assigned user from using the Entra-controlled sign-in path. |
| Group-based access | Membership of every group that grants the application role or assignment. | Removing a person from the access group, provided all access-granting groups are included in the review. |
| Provisioning or synchronization | Entra assignments and the provisioning connection that creates or disables accounts in the application. | Review removal is propagated through active provisioning to the application account. |
| Password-only or non-federated access | A represented list of users, if one exists, plus the application’s own account controls. | Often manual. Removing an Entra assignment may hide the app from My Apps without stopping a person who still knows the application password from signing in. |
For a federated app, make assignment required and review the assigned users or groups. For group-based access, confirm that every group expressing access is covered; reviewing one group while another grants the same role produces a false sense of removal. For applications using provisioning, verify that provisioning is active and that Entra’s assignments correspond to the users who actually have accounts and access in the application.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesIf the application has no federation or provisioning path, you can still use a review to obtain a decision about a represented user list, but assign an owner to apply removals manually. Some per-user delegated consents are not themselves reviewable as application assignments; Conditional Access controls over who may connect can provide a different enforcement point.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Create an access-review policy around the real access path
- Confirm the application is represented in Entra through federation, app-role assignment, group membership, provisioning, or a documented manual roster.
- Identify the exact users, groups, or app-role assignments that grant access. Include nested or alternate groups when they can provide the same entitlement.
- In the Entra access-governance area, create an application access review for that represented access set. Select the application or access group that corresponds to the actual sign-in path rather than reviewing a general employee population.
- Choose reviewers who can judge the business need: the user’s manager, an application owner, a data owner, or a combination appropriate to the sensitivity of the app.
- Define the review recurrence and duration according to risk. Microsoft’s cited guidance does not prescribe one universal interval, so base the schedule on data sensitivity, privilege, ownership stability, and the rate of application or personnel change.
- Set the outcome for users who do not respond or who are rejected, and verify that the selected outcome can be propagated through assignment or provisioning. Where it cannot, document the manual task and its deadline.
- Notify reviewers and users with enough context to make a decision. Include the application name, role or group, last sign-in or business owner evidence where available, and the consequence of removing access.
- After the review closes, verify removals in Entra and, for provisioned applications, in the application itself. Record exceptions, delayed provisioning, and any manual actions.
Do not call an application “periodically reviewed” merely because a questionnaire was sent. The control is effective when the review result reaches the sign-in assignment, group membership, provisioning account, or documented manual owner.
Set a practical review cadence
There is no single Microsoft-mandated interval for every application. Establish a written rule that maps cadence to risk rather than applying one calendar date to the whole tenant.
| Risk signal | Cadence direction | Additional evidence |
|---|---|---|
| Application permissions, sensitive directory or data access, privileged administration, or rapidly changing ownership | More frequent review | Require a named data owner, scope validation, and prompt investigation of non-response. |
| Large user population but ordinary business data and stable ownership | Regular recurring review based on organizational risk | Use group or role assignments so removal is enforceable at scale. |
| Short project, contractor population, or temporary integration | Review at project milestones and at the planned end date | Use an explicit owner and a removal task when the project closes. |
| Password-only or manually enforced access | Review as often as the manual process can reliably complete | Track completion evidence because Entra cannot prove that a rejected user was disabled in the application. |
Write the cadence, reviewer role, evidence requirement, non-response treatment, exception process, and application owner into policy. Revisit the policy when the tenant’s consent settings, licensing, provisioning design, or application risk changes.
Troubleshoot common failures
The user never sees “Approval required”
- Confirm the user’s requested permission is actually outside the tenant’s self-consent policy.
- Verify that the admin consent workflow is enabled and allow up to one hour for propagation.
- Check whether the user can self-consent under another permitted policy path; the workflow only handles requests Entra identifies as requiring administrator action.
No reviewer receives the request
- Confirm the reviewer is assigned in the current settings and that notifications are enabled.
- Check whether the request predates the reviewer’s assignment; later-added reviewers do not receive older requests automatically.
- Verify that the reviewer’s notification address and group membership are current, then reconcile the pending queue manually.
A reviewer can open a request but cannot approve it
- Remember that reviewer designation does not elevate privileges.
- Check the directory role required for the specific permission type. Microsoft’s workflow documentation states that only Global Administrators can approve Microsoft Graph application permissions.
- Escalate to the authorized administrator rather than granting a broad role solely to make the workflow convenient.
Removing a user in the review does not stop sign-in
- Determine whether the user has another assignment or group that grants the same application role.
- Check whether provisioning is active and whether the downstream account was disabled.
- For password-only access, perform the application-side removal or credential change; an Entra assignment removal may affect My Apps visibility without revoking the known password.
The review reports access that the application owner says is incorrect
- Compare Entra assignments, nested groups, app roles, provisioning records, and the application’s own account list.
- Look for direct assignments or a second group that the original review did not include.
- Correct the represented access path before relying on the next review cycle.
Keep consent and access-review records auditable
For each application, maintain a record containing the publisher and owner, requested scopes, permission type, business purpose, approving role, approval or block justification, assigned users or groups, provisioning or federation method, review schedule, exceptions, and removal evidence. Recheck the record when the publisher changes, scopes expand, ownership changes, or the application’s integration path is modified.
Use consent-activity monitoring where available, and periodically inspect privileged directory roles that can alter enterprise applications, assignments, or integrations. A clean approval at one point in time does not validate later permission changes or newly assigned users.
The operating model in one sequence
- Define which user-consent policy applies and which permissions require administrator action.
- Enable the Entra admin consent workflow and configure reviewers, notifications, reminders, and validity.
- Evaluate the publisher, business purpose, permission type, and every requested scope.
- Approve, deny, or block with a recorded justification.
- Require assignment when tenant-wide consent should not mean tenant-wide use.
- Represent the app’s access path through federation, app roles, groups, provisioning, or a documented manual roster.
- Create an access review that covers the complete path and choose a risk-based cadence.
- Verify that review outcomes remove access in Entra and, where applicable, in the application.
- Monitor grants, assignments, privileged roles, ownership, and scope changes between review cycles.
In Microsoft Entra ID, approval and review are complementary controls: consent determines whether the app may receive permissions, while access review determines which people should continue using it. The strongest policy connects the two with least-privilege scopes, explicit assignment, enforceable provisioning or federation, named owners, and evidence for every decision.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →
