Require assignment for high-privilege Microsoft administration tools

Description

The service principals of Microsoft first-party administration tools exist in the tenant, have Assignment required? set to Yes, and are assigned only to the administrators and automation accounts that use them. When a tool is not used at all, sign-in is disabled on its service principal. The list covers at least:

• Microsoft Azure PowerShell (1950a258-227b-4e31-a9cf-717495945fc2);
• Microsoft Azure CLI and Azure Developer CLI (04b07795-8ddb-461a-bbee-02f9e1bf7b46);
• Microsoft Graph Command Line Tools (14d82eec-204b-4c2f-b7e8-296a70dab67e);
• Graph Explorer (de8bc8b5-d9f9-48b1-a8ad-b748da725064);
• Azure Active Directory PowerShell, legacy (1b730954-1685-4b74-9bfd-dac224a7b894);
• Microsoft Teams PowerShell Cmdlets (12128f48-ec9e-42f0-b203-ea49fb6af367);
• Microsoft Exchange Online PowerShell (fb78d390-0c51-40cd-8e17-fdbfab77341b);
• Microsoft SharePoint Online Management Shell (9bc3ab49-b65d-410a-85ad-de819febfddc);
• Power Platform CLI (9cee029c-6210-4654-90bb-17e6e9d36617).

Rationale

These applications are trusted by every tenant and come with broad delegated permissions. After phishing a single user, attackers use them to dump users, groups, applications and policies, the first step toward privilege escalation. Standard users have no business reason to use them. A first-party application can be used even when its service principal is absent from the tenant, so the service principal must be created before assignment can be enforced.

Impact

Administrators, developers and automation that use these tools must be assigned (preferably through a group). Check the sign-in logs of each application to find current users before enforcing.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Enterprise apps > All applications, set Application type to Microsoft Applications, and search each application ID from the list.
3. For each one, open Properties and check Assignment required? = Yes (or Enabled for users to sign-in? = No), then check Users and groups for the assigned principals.
4. In Microsoft Graph PowerShell (scope Application.Read.All), run Get-MgServicePrincipal -Filter "appId eq '<appId>'" -Property displayName,appRoleAssignmentRequired,accountEnabled for each application ID.
5. Fail if a listed service principal is missing, or is enabled with appRoleAssignmentRequired = false.

Remediation

1. For each tool, list current users from Enterprise apps > the application > Sign-in logs.
2. If the service principal is missing, create it with Microsoft Graph PowerShell (scope Application.ReadWrite.All): New-MgServicePrincipal -AppId <appId>.
3. Under Users and groups, assign the group of administrators or automation accounts that need the tool.
4. Under Properties, set Assignment required? to Yes (Graph: Update-MgServicePrincipal -ServicePrincipalId <id> -AppRoleAssignmentRequired:$true), or set Enabled for users to sign-in? to No for tools nobody uses.
5. Role required: Cloud Application Administrator or Application Administrator.

Rollback

Set Assignment required? back to No on the affected application.

References

• Assign users and groups to an enterprise application Microsoft, vendor-doc, accessed 2026-10-24
• Maester MT.1186 - Require explicit assignment of high-privilege first-party Entra apps Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-APPS-015 Require user assignment for third-party enterprise applications
• related CB-M365-AUTH-046 Block the legacy MSOnline PowerShell module from the tenant

People and lifecycle