Require user assignment for third-party enterprise applications

Description

Enterprise applications published by third parties (service principals whose appOwnerOrganizationId is neither the tenant nor Microsoft) have Assignment required? set to Yes. Access is granted to groups that match the business need. Applications meant for all staff are assigned to an all-employees group rather than left open.

Rationale

An application open to all users extends the reach of every compromised account: the attacker can sign in to it, obtain tokens with the consented delegated permissions and use the application as a data path. Requiring assignment also gives an access list that can be reviewed and removed when people leave.

Impact

Users who are not assigned get an error when they sign in. Assign groups before switching the setting, and check the application's sign-in logs to find current users.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Enterprise apps > All applications, filter on Application type = Enterprise applications, and for each third-party application open Properties and read Assignment required?.
3. In Microsoft Graph PowerShell (scope Application.Read.All), run Get-MgServicePrincipal -All -Property displayName,appId,appOwnerOrganizationId,appRoleAssignmentRequired,accountEnabled and keep entries whose appOwnerOrganizationId differs from your tenant ID and from f8cdef31-a31e-4b4a-93e4-5f571e91255a (Microsoft).
4. Fail if an enabled third-party application has appRoleAssignmentRequired = false without a documented exception.

Remediation

1. Find the current users in Enterprise apps > the application > Sign-in logs.
2. Under Users and groups, assign the groups that need access.
3. Under Properties, set Assignment required? to Yes and select Save.
4. Graph alternative (scope Application.ReadWrite.All): Update-MgServicePrincipal -ServicePrincipalId <id> -AppRoleAssignmentRequired:$true.
5. Role required: Cloud Application Administrator or Application Administrator.

Rollback

Set Assignment required? back to No.

References

• Assign users and groups to an enterprise application Microsoft, vendor-doc, accessed 2026-10-24
• Maester test catalogue (MT.1075) Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-APPS-017 Require assignment for high-privilege Microsoft administration tools

People and lifecycle