⭐ Repository → 📁 Compliance Engine → 📁 CloudAware → 📁 Azure → 📁 Microsoft Entra ID

🛡️ Microsoft Entra ID Users Can Register Applications is set to Yes🟢

• Contextual name: 🛡️ Users Can Register Applications is set to Yes🟢
• ID: /ce/ca/azure/microsoft-entra-id/disable-users-can-register-applications
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Active Directory
  • 🔌 Azure Active Directory Auth Policy - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: Users Can Register Applications

Description

Open File

Description

Require administrators or appropriately delegated users to register third-party applications.

Rationale

It is recommended to only allow an administrator to register custom-developed applications. This ensures that the application undergoes a formal security review and approval process prior to exposing Microsoft Entra ID data. Certain users like developers or other high-request users may also be delegated permissions to prevent them from waiting on an administrative user. Your organization should review your policies and decide your needs.

Impact

Enforcing this setting will create additional requests for approval that will need to be addressed by an administrator. If permissions are delegated, a user may approve a malevolent third party application, potentially giving it access to your data.

Audit

This policy marks an Azure Active Directory as INCOMPLIANT if the related Active Directory Auth Policy has Default Permission: Create Apps set to Enabled. This field corresponds to the Users can register applications setting in the Microsoft Entra admin center’s User settings when enabled (set to Yes).

... see more

Remediation

Open File

Remediation

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Entra ID.
3. Under Manage, select Users.
4. Under Manage, select User settings.
5. Set Users can register applications to No.
6. Click Save.

From PowerShell

$param = @{ AllowedToCreateApps = "$false" } Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $param

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v2.1.0 → 💼 1.13 Ensure That Users Can Register Applications Is Set to No - Level 1 (Manual)			1		no data
💼 CIS Azure v3.0.0 → 💼 2.14 Ensure That 'Users Can Register Applications' Is Set to 'No' (Automated)			1		no data
💼 CIS Azure v4.0.0 → 💼 6.14 Ensure that 'Users can register applications' is set to 'No' (Automated)			1		no data
💼 Cloudaware Framework → 💼 User Account Management			17		no data