{
  "id": "CB-M365-APPS-015",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-015",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-015.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-015.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-APPS-015",
    "title": "Require user assignment for third-party enterprise applications",
    "finding": {
      "title": "Third-party applications let any user of the tenant sign in",
      "description": "When assignment is not required, every account, including a compromised one, can sign in to the application and use the permissions consented for it."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "applications",
      "enterprise-apps",
      "assignment",
      "least-privilege"
    ],
    "description": "Enterprise applications published by third parties (service principals whose\n`appOwnerOrganizationId` is neither the tenant nor Microsoft) have **Assignment required?** set\nto **Yes**. Access is granted to groups that match the business need. Applications meant for all\nstaff are assigned to an all-employees group rather than left open.\n",
    "rationale": "An application open to all users extends the reach of every compromised account: the attacker\ncan sign in to it, obtain tokens with the consented delegated permissions and use the\napplication as a data path. Requiring assignment also gives an access list that can be reviewed\nand removed when people leave.\n",
    "impact": "Users who are not assigned get an error when they sign in. Assign groups before switching the\nsetting, and check the application's sign-in logs to find current users.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Enterprise apps** > **All applications**, filter on **Application\n   type** = **Enterprise applications**, and for each third-party application open\n   **Properties** and read **Assignment required?**.\n3. In Microsoft Graph PowerShell (scope `Application.Read.All`), run\n   `Get-MgServicePrincipal -All -Property displayName,appId,appOwnerOrganizationId,appRoleAssignmentRequired,accountEnabled`\n   and keep entries whose `appOwnerOrganizationId` differs from your tenant ID and from\n   `f8cdef31-a31e-4b4a-93e4-5f571e91255a` (Microsoft).\n4. Fail if an enabled third-party application has `appRoleAssignmentRequired` = `false` without\n   a documented exception.\n"
    },
    "remediation": {
      "manual": "1. Find the current users in **Enterprise apps** > the application > **Sign-in logs**.\n2. Under **Users and groups**, assign the groups that need access.\n3. Under **Properties**, set **Assignment required?** to **Yes** and select **Save**.\n4. Graph alternative (scope `Application.ReadWrite.All`):\n   `Update-MgServicePrincipal -ServicePrincipalId <id> -AppRoleAssignmentRequired:$true`.\n5. Role required: Cloud Application Administrator or Application Administrator.\n",
      "rollback": "Set **Assignment required?** back to **No**.\n"
    },
    "references": [
      {
        "title": "Assign users and groups to an enterprise application",
        "url": "https://learn.microsoft.com/entra/identity/enterprise-apps/assign-user-or-group-access-portal",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester test catalogue (MT.1075)",
        "url": "https://maester.dev/docs/tests/",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-APPS-017",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}