{
  "id": "CB-M365-APPS-014",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-014",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-014.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-014.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-APPS-014",
    "title": "Enable app instance property lock on multitenant applications",
    "finding": {
      "title": "Sensitive properties of the organization's applications can be changed in other tenants",
      "description": "Without a property lock, an administrator of any tenant where the application is installed can add credentials to its local service principal and use the application's identity there."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "applications",
      "workload-identities",
      "credentials",
      "multitenant"
    ],
    "description": "Every application registration has **App instance property lock** enabled with **All\nproperties** selected (credentials used for verification, credentials used for signing tokens,\nand `tokenEncryptionKeyId`), unless the application documents a scenario that needs one of\nthese properties on its service principals.\n",
    "rationale": "Service principals of an application can receive their own credentials in every tenant where the\napplication is present. For a multitenant application published by the organization, a\ncredential added in a customer or attacker tenant lets someone authenticate as the application\nthere. The lock prevents these changes on service principals, which almost no application needs.\nMicrosoft enables the lock by default for applications created since June 2026; older\napplications must be updated.\n",
    "impact": "Applications that rely on service principal credentials (for example SAML signing certificates\nmanaged on the enterprise application) must keep the matching property unlocked.\n",
    "setting": {
      "location": "Entra admin center > Entra ID > App registrations > application > Authentication > App instance property lock (Graph application.servicePrincipalLockConfiguration)",
      "default_value": "Enabled for applications created since June 2026, not configured before",
      "recommended_value": "Enabled, All properties"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **App registrations** > **All applications**, open each application\n   and check **Authentication** > **App instance property lock**.\n3. In Microsoft Graph PowerShell (scope `Application.Read.All`), run\n   `Get-MgApplication -All -Property displayName,appId,signInAudience,servicePrincipalLockConfiguration`\n   and check `isEnabled` and `allProperties`.\n4. Fail if a multitenant application (`signInAudience` other than `AzureADMyOrg`) has the lock\n   disabled, or if any application has it disabled without a documented reason.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.\n2. Browse to **Entra ID** > **App registrations**, open the application, select\n   **Authentication** and select **Configure** under **App instance property lock**.\n3. Select **Enable property lock** and **All properties**, then **Save**.\n4. Graph alternative (scope `Application.ReadWrite.All`):\n   `PATCH https://graph.microsoft.com/v1.0/applications/{id}` with\n   `{\"servicePrincipalLockConfiguration\": {\"isEnabled\": true, \"allProperties\": true}}`.\n",
      "rollback": "Clear **Enable property lock**, or unlock only the property the application needs.\n"
    },
    "references": [
      {
        "title": "How to configure app instance property lock in your applications",
        "url": "https://learn.microsoft.com/entra/identity-platform/howto-configure-app-instance-property-locks",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Configure Microsoft Entra for increased security - protect tenants",
        "url": "https://learn.microsoft.com/entra/fundamentals/zero-trust-protect-tenants",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1098.001"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}