Enable app instance property lock on multitenant applications

Description

Every application registration has App instance property lock enabled with All properties selected (credentials used for verification, credentials used for signing tokens, and tokenEncryptionKeyId), unless the application documents a scenario that needs one of these properties on its service principals.

Rationale

Service principals of an application can receive their own credentials in every tenant where the application is present. For a multitenant application published by the organization, a credential added in a customer or attacker tenant lets someone authenticate as the application there. The lock prevents these changes on service principals, which almost no application needs. Microsoft enables the lock by default for applications created since June 2026; older applications must be updated.

Impact

Applications that rely on service principal credentials (for example SAML signing certificates managed on the enterprise application) must keep the matching property unlocked.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > App registrations > All applications, open each application and check Authentication > App instance property lock.
3. In Microsoft Graph PowerShell (scope Application.Read.All), run Get-MgApplication -All -Property displayName,appId,signInAudience,servicePrincipalLockConfiguration and check isEnabled and allProperties.
4. Fail if a multitenant application (signInAudience other than AzureADMyOrg) has the lock disabled, or if any application has it disabled without a documented reason.

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
2. Browse to Entra ID > App registrations, open the application, select Authentication and select Configure under App instance property lock.
3. Select Enable property lock and All properties, then Save.
4. Graph alternative (scope Application.ReadWrite.All): PATCH https://graph.microsoft.com/v1.0/applications/{id} with {"servicePrincipalLockConfiguration": {"isEnabled": true, "allProperties": true}}.

Rollback

Clear Enable property lock, or unlock only the property the application needs.

References

• How to configure app instance property lock in your applications Microsoft, vendor-doc, accessed 2026-10-24
• Configure Microsoft Entra for increased security - protect tenants Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle