cirsec Baselines
Esc
Microsoft 365 tenant · Applications, consent & AI agents

Restrict application registration to administrators

When it fails: Any user can register applications in the tenant. A standard user, or an attacker holding one user account, can create an application, give it credentials and use it as a persistent foothold or a phishing tool trusted by the tenant.

CB-M365-APPS-001mediumactivemanualprofile baseline

Description

The default user role cannot create application registrations. The tenant setting Users can register applications is set to No, so only holders of a role that grants application creation (Application Developer, Application Administrator, Cloud Application Administrator, or a custom role with microsoft.directory/applications/createAsOwner) can register applications.

Rationale

By default every member user can register an application, add a secret to it and request permissions. Attackers use this to create an application they own inside the tenant, which survives a password reset of the compromised account, or to stand up an illicit consent phishing app that looks internal. Restricting registration puts every new application through a team that reviews its purpose and permissions.

Impact

Developers who registered their own applications must request the Application Developer role (eligible through PIM where available) or go through the team that manages app registrations. Existing applications and their owners are not affected.

Setting

LocationEntra admin center > Entra ID > Users > User settings > Users can register applications (Graph authorizationPolicy.defaultUserRolePermissions.allowedToCreateApps)
DefaultYes
RecommendedNo

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to Entra ID > Users > User settings.
  3. Check that Users can register applications is set to No.
  4. Alternative in Microsoft Graph PowerShell (scope Policy.Read.All): (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.AllowedToCreateApps, or Graph GET https://graph.microsoft.com/v1.0/policies/authorizationPolicy.
  5. Fail if the setting is Yes or allowedToCreateApps is true.

Remediation

  1. Give the Application Developer role (preferably eligible through PIM) to the people who legitimately create applications.
  2. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
  3. Browse to Entra ID > Users > User settings.
  4. Set Users can register applications to No and select Save.
  5. Alternative in Microsoft Graph PowerShell (scope Policy.ReadWrite.Authorization): Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{ AllowedToCreateApps = $false }.

Rollback

Set Users can register applications back to Yes.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1AC-6related
NIST SP 800-53 Rev. 55.1.1CM-11related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.AAD.5.1v1equivalent

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1098
MITRE ATT&CKT1566
  • related CB-M365-APPS-002 Restrict user consent to applications
  • related CB-M365-APPS-020 Restrict creation of agent identity blueprints to administrators
  • related CB-M365-TENANT-001 Restrict tenant creation to administrators
  • related CB-M365-TENANT-009 Disable self-service sign-up to the tenant
  • related CB-M365-POWER-019 Restrict Fabric public API access by service principals to approved groups
  • related CB-M365-POWER-020 Restrict service principal profiles in Power BI to approved groups
  • related CB-M365-POWER-021 Restrict service principals from creating Fabric workspaces, connections and deployment pipelines

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr