{
  "id": "CB-M365-APPS-016",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-016",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-016.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-016.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-APPS-016",
    "title": "Disable or delete inactive, test and demo applications",
    "finding": {
      "title": "Unused, test or demo applications remain enabled in the tenant",
      "description": "Forgotten applications keep their permissions and credentials, are reviewed by nobody and are an easy place for an attacker to hide."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "applications",
      "workload-identities",
      "hygiene",
      "lifecycle"
    ],
    "description": "Application registrations and service principals with no sign-in for\n**{{ app_inactivity_days }}** days, and applications whose name or notes show a test, demo or\nproof-of-concept purpose, are disabled and then deleted after confirmation with their owner.\nTest applications live in a separate development tenant.\n",
    "rationale": "Each enabled application is an identity with permissions and possibly credentials. Unused ones\nbring no value and are rarely monitored, which makes them attractive for persistence: adding a\nsecret to a dormant application raises less suspicion than creating a new one. Test\napplications are often created with broad permissions and weak settings.\n",
    "impact": "An application used only once a year (annual campaign, disaster recovery) may look inactive.\nDisable before deleting, and keep a short documented exception list. Deleted applications stay\nrestorable for 30 days.\n",
    "parameters": [
      {
        "name": "app_inactivity_days",
        "type": "integer",
        "description": "Number of days without sign-in after which an application is considered inactive.",
        "unit": "days",
        "default": 90,
        "minimum": 30
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Overview** > **Recommendations** and open **Remove unused\n   applications**; note each active item.\n3. Browse to **Entra ID** > **Monitoring & health** > **Usage & insights** and review sign-in\n   activity per application and service principal.\n4. In Microsoft Graph (scope `AuditLog.Read.All`, beta), read\n   `GET https://graph.microsoft.com/beta/reports/servicePrincipalSignInActivities` for the last\n   sign-in of each application.\n5. Search application display names for terms such as `test`, `demo`, `poc`, `sandbox`, `temp`.\n6. Fail if an enabled application has had no sign-in for {{ app_inactivity_days }} days, or a\n   test or demo application exists in the production tenant, without a documented exception.\n"
    },
    "remediation": {
      "manual": "1. Contact the owner of each flagged application.\n2. Disable sign-in first: **Enterprise apps** > the application > **Properties** > **Enabled for\n   users to sign-in?** = **No** (Graph: `Update-MgServicePrincipal -AccountEnabled:$false`).\n3. After an observation period with no complaint, delete the application under **App\n   registrations** > the application > **Delete** (or **Enterprise apps** > **Properties** >\n   **Delete** for third-party service principals).\n4. Role required: Cloud Application Administrator or Application Administrator.\n",
      "rollback": "Re-enable sign-in, or restore the application from **App registrations** > **Deleted\napplications** within 30 days.\n"
    },
    "references": [
      {
        "title": "Remove unused applications recommendation",
        "url": "https://learn.microsoft.com/entra/identity/monitoring-health/recommendation-remove-unused-apps",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Disable user sign-in for an application",
        "url": "https://learn.microsoft.com/entra/identity/enterprise-apps/disable-user-sign-in-portal",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Delete an enterprise application",
        "url": "https://learn.microsoft.com/entra/identity/enterprise-apps/delete-application-portal",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2(3)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-APPS-010",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}