Microsoft Entra IDOverview
Require administrators or appropriately delegated users to register third-party applications.
Rationale
It is recommended that only an administrator register custom-developed applications. This ensures the application undergoes a formal security review and approval process before exposing Microsoft Entra ID data. Certain users, like developers or other high-request users, may also be delegated permissions to prevent them from waiting on an administrative user. Your organization should review your policies and decide your needs.
Impact
Enforcing this setting will create additional requests for approval that will need to be addressed by an administrator. If permissions are delegated, a user may approve a malevolent third-party application, potentially giving it access to your data.
Default Value
By default, Users can register applications is set to "Yes".
Remediation guidance
From Azure Portal
- Open Users | User Settings.
- Set
Users can register applicationstoNo.
From Powershell
$param = @{ AllowedToCreateApps = "$false" }
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $param
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Microsoft Entra ID
Use tenant-wide Conditional Access, role settings, authentication policies, and identity governance baselines so the control is enforced centrally.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Entra Tenants allowing users to register apps
Connectors
Covered asset types
Expected check: eq []
{
connectors(where: { directoryProperties: { usersCanRegisterApps: true } }) {
...AssetFragment
}
}
