MT.1106 - Catalog resources must have valid roles (no stale / removed app roles or SPNs).

Contributed by nicowyss with Jean-Philippe GeorgeAll contributors →

Overview

This test identifies Microsoft Entra ID Governance access package catalog resources that reference stale or invalid roles, deleted service principals, or non-existent SharePoint sites. When applications or sites are reconfigured or deleted, catalogs often retain "ghost roles" that cause provisioning failures.

The test validates:

• Service principals referenced by applications are active and accessible
• Application roles assigned in access packages still exist in their service principals
• SharePoint sites have valid URLs and are accessible via Microsoft Graph API
• Resources are properly configured

Note: Group validation is handled by MT.1107. Built-in roles are excluded as they are system-managed. "Default Access" roles are skipped as system defaults.

Stale resources detected:

• Deleted service principals - Application removed from tenant (404 error)
• Stale app roles - Roles removed from service principal but still assigned in packages
• Invalid SharePoint URLs - Site URL format incorrect or site deleted/moved
• Inaccessible sites - Site exists but cannot be accessed via Graph API

Remediation action

For Deleted Service Principals/Applications:

Option 1: Remove from Catalog

1. Navigate to Entra Admin Center → Identity Governance → Catalogs
2. Select the catalog → Resources section
3. Select the stale application resource
4. Click Remove from catalog
5. Update any access packages that referenced this resource

Option 2: Restore Application

1. Check Entra Admin Center → Enterprise applications → Deleted applications
2. Restore the application if within recovery window
3. Verify catalog resource is now valid

For Stale App Roles:

1. Identify the app role from test results
2. Find the service principal in Entra portal
3. If role removed intentionally:
   • Edit the access package
   • Remove the stale resource role assignment
   • Add a valid app role if needed
4. If role should exist:
   • Contact application owner to restore role in app manifest
   • Update app registration to add role back

For SharePoint Sites:

Option 1: Remove from Catalog

1. Navigate to catalog → Resources
2. Select the site and click Remove from catalog
3. Update access packages

Option 2: Fix Site URL (if moved/renamed)

1. Verify correct URL in SharePoint Admin Center
2. Remove old site resource from catalog
3. Add site with correct URL as new resource
4. Update access packages

Option 3: Restore Site

1. Check SharePoint Admin Center → Deleted sites
2. Restore site if within 93-day recovery window
3. Verify accessibility

Related links

• Microsoft Entra ID Governance Documentation
• Manage Catalog Resources
• Service Principal App Roles
• SharePoint Site Resource Type
• Microsoft Graph API - Entitlement Management

Test Metadata

Field	Value
Test ID	MT.1106
Severity	Low
Suite	Maester
Product	Entra ID
Feature	Identity Governance
Area	Identity lifecycle and hygiene
Resource type	AccessPackage
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	None
PowerShell test	Test-MtEntitlementManagementValidResourceRoles
Services	Graph
Compatible licenses	AAD_PREMIUM_P2, Entra_Identity_Governance

Source

• Test: tests/maester/entra/Test.MT.1106.ps1
• Documentation: tests/maester/entra/Test.MT.1106.md