CISA.MS.AAD.5.1 - Only administrators SHALL be allowed to register applications.
Overview
Only administrators SHALL be allowed to register applications.
Rationale: Application access for the tenant presents a heightened security risk compared to interactive user access because applications are typically not subject to critical security protections, such as MFA policies. Reduce risk of unauthorized users installing malicious applications into the tenant by ensuring that only specific privileged users can register applications.
Remediation action:
- In Entra, under Identity and Users, select User settings.
- For Users can register applications, select No.
- Click Save.
Related links
- Entra admin center - User settings
- CISA Application Registration & Consent - MS.AAD.5.1v1
- CISA ScubaGear Rego Reference
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.AAD.5.1 |
| Severity | Medium |
| Suite | CISA |
| Product | Entra ID |
| Feature | User and directory settings |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1098.001 Additional Cloud Credentials, T1098.003 Additional Cloud Roles, T1528 Steal Application Access Token |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.5.1 |
| Criticality | SHALL |
| Upstream requirement | MS.AAD.5.1v1 |
| Supports controls | cisa-scuba:MS.AAD.5.1, nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5 |
| PowerShell test | Test-MtCisaAppRegistration |
| Services | Graph |
Source
- Test:
tests/cisa/entra/Test.CISA.MS.AAD.5.1.ps1 - Documentation:
tests/cisa/entra/Test.CISA.MS.AAD.5.1.md