Restrict and protect owners of privileged applications

Description

Ownership of application registrations and service principals follows two rules:

• applications that hold privileged API permissions (CB-M365-APPS-011) or a privileged directory role have no user owners; they are managed by administrators through roles;
• every owner of any other application is an active member account with MFA registered.

Rationale

Owners can manage credentials of their applications without holding any admin role. If a standard user owns an application that has RoleManagement.ReadWrite.Directory or the Privileged Role Administrator role, compromising that user is enough to become Global Administrator. Removing owners from privileged applications and requiring MFA from all owners closes this escalation path.

Impact

Former owners of privileged applications must ask an Application Administrator or Cloud Application Administrator to change credentials or settings.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. For each privileged application identified in CB-M365-APPS-011 and each service principal listed under Entra ID > Roles & admins with a privileged role, open App registrations > the application > Owners and Enterprise apps > the application > Owners.
3. In Microsoft Graph PowerShell (scopes Application.Read.All, Directory.Read.All), list owners with Get-MgApplicationOwner -ApplicationId <id> and Get-MgServicePrincipalOwner -ServicePrincipalId <id>.
4. For the owners of other applications, check MFA registration under Entra ID > Authentication methods > User registration details (or Get-MgReportAuthenticationMethodUserRegistrationDetail, field isMfaRegistered).
5. Fail if a privileged application has a user owner, or if any owner is disabled, a guest without justification, or has no MFA method registered.

Remediation

1. Remove user owners from privileged applications: App registrations > the application > Owners > Remove owners, and the same under Enterprise apps. Graph alternative: Remove-MgApplicationOwnerByRef and Remove-MgServicePrincipalOwnerByRef.
2. Delegate management of these applications through Application Administrator or Cloud Application Administrator roles, scoped to the application where possible, and eligible through PIM.
3. For other applications, ask owners without MFA to register a method, or replace them.
4. Role required: Cloud Application Administrator (Privileged Role Administrator for applications holding privileged roles).

Rollback

Add the previous owner back under Owners.

References

• Overview of enterprise application ownership Microsoft, vendor-doc, accessed 2026-10-24
• Maester test catalogue (MT.1063, MT.1077, MT.1078) Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-APPS-011 Review high-risk API permissions granted to applications
• related CB-M365-AUTH-018 Make sure every member user has registered an MFA method

People and lifecycle