MT.1063 - All App registration owners should have MFA registered
Overview
This test checks if all owners of app registrations have Multi-Factor Authentication (MFA) registered. App registration owners without MFA pose a significant security risk as credential stuffing attacks can lead to privileged access and potential privilege escalation or data loss.
Why This Matters
App registration owners have powerful permissions that attackers actively target:
- Credential Stuffing Risk: Without MFA, compromised passwords from data breaches provide immediate access
- Privileged App Access: Owners can modify app permissions, certificates, and redirect URIs
- Privilege Escalation: Compromised owners can grant themselves or malicious apps excessive permissions
- Lateral Movement: Access to one app registration can be leveraged to compromise other resources
Attack Scenario
- Initial Compromise: Attacker uses leaked credentials to access owner account (no MFA protection)
- App Manipulation: Attacker modifies app registration to add malicious redirect URIs, certificates or secrets
- Broader Access: Compromised app is used to access sensitive data across the organization or to escalate privileges
Remediation action
Register MFA for all app registration owners listed. Use Conditional Access policies to enforce MFA for all application owners.
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1063 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | User |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1098.001 Additional Cloud Credentials, T1110.004 Credential Stuffing |
| Supports controls | nist-800-53-r5:IA-2(1), nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtAppRegistrationOwnersWithoutMFA |
| Services | Graph |
| Long running | Yes |
Source
- Test:
tests/maester/entra/Test.MT.1063.ps1 - Documentation:
tests/maester/entra/Test.MT.1063.md