CIS.M365.5.1.2.2 - (L1) Ensure users cannot register applications
Overview
5.1.2.2 (L1) Ensure users cannot register applications
This setting controls whether standard users can register applications in the Microsoft Entra ID directory. When enabled, any user can create app registrations, which function as identity objects for applications.
Rationale
Allowing standard users to create app registrations expands the tenant's attack surface. A compromised account or malicious insider could create a rogue app registration to establish a persistent OAuth client, facilitate token theft, or impersonate a legitimate application. Restricting app registration to privileged roles ensures that new application identities in the directory are subject to administrative review and approval before they can be granted permissions to organizational resources.
Impact
End users will no longer be able to register applications independently, including both third-party integrations and custom applications. Developers and IT staff who create app registrations as part of normal workflows will be affected and will need to submit registration requests to a privileged administrator (e.g., Application Administrator or Cloud Application Administrator). Organizations should establish a formal request and approval process before implementing this change to avoid workflow disruption.
Remediation action
- Navigate to Microsoft 365 Entra admin center.
- Click to expand Entra ID > Users select Users settings.
- Set Users can register applications to No.
- Click Save.
PowerShell
- Connect to Microsoft Graph using
Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" - Run the following commands:
$param = @{ AllowedToCreateApps = $false }
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $param
Related links
- Microsoft 365 Entra admin center
- How and why applications are added to Microsoft Entra ID
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 197
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.1.2.2 |
| Severity | Unknown |
| Suite | CIS |
| Category | CIS E3 Level 1 |
| PowerShell test | Test-MtCisThirdPartyApplicationsDisallowed |
| Tags | CIS, CIS E3, CIS E3 Level 1, CIS E5, CIS E5 Level 1, CIS M365 v7.0.0, CIS.M365.5.1.2.2, L1, Security |
Source
- Pester test:
tests/cis/Test-MtCisThirdPartyApplicationsDisallowed.Tests.ps1 - PowerShell source:
powershell/public/cis/Test-MtCisThirdPartyApplicationsDisallowed.ps1