ms.subservice: enterprise-apps
ms.topic: how-to
ms.date: 10/15/2025
ms.author: jomondi
ms.reviewer: ergreenl, phsignor
ms.custom: enterprise-apps
Every tenant comes with a set of app consent policies that are the same across all tenants. Some of these built-in policies are used in existing built-in directory roles. For example, the `microsoft-application-admin` app consent policy describes the conditions under which the Application Administrator and Cloud Application Administrator roles are allowed to grant tenant-wide admin consent. Built-in policies can be used in custom directory roles or to configure an organization's default consent policy. These policies can't be edited. A list of the built-in policies are:
- **microsoft-user-default-low:** All low risk permissions consentable by member type users by default.
- **microsoft-user-default-recommended:** Permissions consentable based on Microsoft's current recommendations.
- **microsoft-all-application-permissions:** Includes all application permissions (app roles), for all APIs, for any client application.
- **microsoft-dynamically-managed-permissions-for-chat:** Includes dynamically managed permissions allowed for chat resource-specific consent.
- **microsoft-all-application-permissions-for-chat:** Includes all chat resource-specific application permissions, for all APIs, for any client application.
- **microsoft-company-admin:** Permissions consentable by Company Administrators.
> [!WARNING]
> Microsoft-user-default-recommended is a Microsoft managed policy. The conditions included in the policy are automatically updated based on Microsoft's latest security recommendations for end-user consent.
## Microsoft recommended current settings
ms.subservice: enterprise-apps
ms.topic: how-to
ms.date: 01/05/2026
ms.author: jomondi
ms.reviewer: ergreenl, phsignor
ms.custom: enterprise-apps
Every tenant comes with a set of app consent policies that are the same across all tenants. Some of these built-in policies are used in existing built-in directory roles. For example, the `microsoft-application-admin` app consent policy describes the conditions under which the Application Administrator and Cloud Application Administrator roles are allowed to grant tenant-wide admin consent. Built-in policies can be used in custom directory roles or to configure an organization's default consent policy. These policies can't be edited. A list of the built-in policies are:
- **microsoft-user-default-low:** All low risk permissions consentable by member type users by default.
- **microsoft-user-default-recommended:** Permissions consentable based on Microsoft's current recommendations.
- **microsoft-user-default-consent-apps:** Popular mail clients consentable for users
- **microsoft-all-application-permissions:** Includes all application permissions (app roles), for all APIs, for any client application.
- **microsoft-dynamically-managed-permissions-for-chat:** Includes dynamically managed permissions allowed for chat resource-specific consent.
- **microsoft-all-application-permissions-for-chat:** Includes all chat resource-specific application permissions, for all APIs, for any client application.
- **microsoft-company-admin:** Permissions consentable by Company Administrators.
> [!WARNING]
> Microsoft-user-default-recommended and microsoft-user-default-consent-apps are a Microsoft managed policies. The conditions included in the policies are automatically updated based on Microsoft's latest security recommendations for end-user consent.
## Microsoft recommended current settings