🛡️ Microsoft Entra ID Users Can Register Applications is set to Yes🟢

• Contextual name: 🛡️ Users Can Register Applications is set to Yes🟢
• ID: /ce/ca/azure/microsoft-entra-id/disable-users-can-register-applications
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Active Directory
  • 🔌 Azure Active Directory Auth Policy - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: Users Can Register Applications

Description

Open File

Description

Require administrators or appropriately delegated users to register third-party applications.

Rationale

It is recommended to only allow an administrator to register custom-developed applications. This ensures that the application undergoes a formal security review and approval process prior to exposing Microsoft Entra ID data. Certain users like developers or other high-request users may also be delegated permissions to prevent them from waiting on an administrative user. Your organization should review your policies and decide your needs.

Impact

Enforcing this setting will create additional requests for approval that will need to be addressed by an administrator. If permissions are delegated, a user may approve a malicious third-party application, potentially giving it access to your data.

Audit

This policy marks an Azure Active Directory as INCOMPLIANT if the related Active Directory Auth Policy has Default Permission: Create Apps set to Enabled. This field corresponds to the Users can register applications setting in the Microsoft Entra admin center’s User settings when enabled (set to Yes).

... see more

Remediation

Open File

Remediation

From Azure Portal

1. In the Azure portal, open the portal menu.
2. Select Microsoft Entra ID.
3. Under Manage, select Users.
4. Under Manage, select User settings.
5. Set Users can register applications to No.
6. Click Save.

From PowerShell

$param = @{ AllowedToCreateApps = "$false" }
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $param

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v5.0.0 → 💼 5.14 Ensure that 'Users can register applications' is set to 'No' (Automated)			1		no data
💼 Cloudaware Framework → 💼 General Access Controls			23		no data