EIDSCA.AP10 - Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.

Contributed by Thomas NaunheimAll contributors →

Overview

Controls if non-admin users may register custom-developed applications for use within this directory.

CISA SCuBA 2.6: Only Administrators SHALL Be Allowed To Register Third-Party Applications

Test script

https://graph.microsoft.com/beta/policies/authorizationPolicy
.defaultUserRolePermissions.allowedToCreateApps -eq 'false'

Remediation action

Microsoft Graph PowerShell: Update-MgPolicyAuthorizationPolicy -BodyParameter @{ DefaultUserRolePermissions = @{ AllowedToCreateApps = $false }}

Related links

• Open in Graph Explorer
• authorizationPolicy resource type - Microsoft Graph beta | Microsoft Learn
• View in Microsoft Entra admin center

MITRE ATT&CK

Tactic	Technique	Mitigation
TA0001 - Initial Access - Initial Access TA0005 - Defense Evasion - Stealth TA0006 - Credential Access - Credential Access TA0008 - Lateral Movement - Lateral Movement	T1566.002 - Phishing: Spearphishing Link T1078 - Valid Accounts T1550 - Use Alternate Authentication Material T1528 - Steal Application Access Token	M1017 - User Training M1018 - User Account Management M1024 - Restrict Registry Permissions M1047 - Audit

Test Metadata

Field	Value
Test ID	EIDSCA.AP10
Severity	Medium
Suite	Entra ID SCA
Product	Entra ID
Feature	User and directory settings
Area	Applications and workload identities
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1098.001 Additional Cloud Credentials, T1528 Steal Application Access Token
Supports controls	nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5
PowerShell test	Test-MtCheckEidscaAP10
Services	Graph

Source

• Test: tests/eidsca/Test.EIDSCA.AP10.ps1
• Documentation: tests/eidsca/Test.EIDSCA.AP10.md