Description
Application registrations and service principals with no sign-in for {{ app_inactivity_days }} days, and applications whose name or notes show a test, demo or proof-of-concept purpose, are disabled and then deleted after confirmation with their owner. Test applications live in a separate development tenant.
Rationale
Each enabled application is an identity with permissions and possibly credentials. Unused ones bring no value and are rarely monitored, which makes them attractive for persistence: adding a secret to a dormant application raises less suspicion than creating a new one. Test applications are often created with broad permissions and weak settings.
Impact
An application used only once a year (annual campaign, disaster recovery) may look inactive. Disable before deleting, and keep a short documented exception list. Deleted applications stay restorable for 30 days.
Parameters
| Parameter | Baseline | Hardened | Bounds |
|---|---|---|---|
app_inactivity_daysinteger, days. Number of days without sign-in after which an application is considered inactive. | 90 | 90 | at least 30 |
The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.
Audit
- Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
- Browse to Entra ID > Overview > Recommendations and open Remove unused applications; note each active item.
- Browse to Entra ID > Monitoring & health > Usage & insights and review sign-in activity per application and service principal.
- In Microsoft Graph (scope
AuditLog.Read.All, beta), readGET https://graph.microsoft.com/beta/reports/servicePrincipalSignInActivitiesfor the last sign-in of each application. - Search application display names for terms such as
test,demo,poc,sandbox,temp. - Fail if an enabled application has had no sign-in for {{ app_inactivity_days }} days, or a test or demo application exists in the production tenant, without a documented exception.
Remediation
- Contact the owner of each flagged application.
- Disable sign-in first: Enterprise apps > the application > Properties > Enabled for
users to sign-in? = No (Graph:
Update-MgServicePrincipal -AccountEnabled:$false). - After an observation period with no complaint, delete the application under App registrations > the application > Delete (or Enterprise apps > Properties > Delete for third-party service principals).
- Role required: Cloud Application Administrator or Application Administrator.
Rollback
Re-enable sign-in, or restore the application from App registrations > Deleted applications within 30 days.
References
- Remove unused applications recommendation Microsoft, vendor-doc, accessed 2026-10-24
- Disable user sign-in for an application Microsoft, vendor-doc, accessed 2026-10-24
- Delete an enterprise application Microsoft, vendor-doc, accessed 2026-10-24
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | AC-2(3) | related |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Related controls
- related
CB-M365-APPS-010Clean up and rotate existing application credentials
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
