Is Publisher Verification will change how admin consent works for graph scope?

Question

Hi,
I wanted to ask regarding the admin consent in Microsoft Graph that I found for Schedule.ReadWrite in multitenant environment is needed to get approved by Admin from other tenant first before we can read or write to their user's calendars. Then, I stumbled to the article about Publisher Verification that can evaluate the OAuth consent request (https://learn.microsoft.com/en-us/entra/identity-platform/publisher-verification-overview#frequently-asked-questions).
So, my question is,

• With Publisher Verification, do we can change the consent approval to each user instead of admin of the tenant?
• Is there any other way to change the consent approval to each user instead of admin of the tenant?

Thank you

Answer 1

No, Publisher verification will not allow you to bypass the admin consent requirement. Some permissions are simply considered "sensitive" and cannot be consented by end users. The same applies for any tenant-wide permissions (usually, any of the application permissions). While there are some controls for tenants to define which specific scopes can a user grant consent to, this does not affect scopes requiring admin consent, and it's not something that you as the application owner can control.

That said, you should still add Publisher verification to all your applications, as Microsoft is marking apps without verification as "risky", read here: https://learn.microsoft.com/en-us/entra/identity-platform/publisher-verification-overview#benefits