Detections
Analytics

5.1.2.2 (L2) Ensure third party integrated applications are not allowed

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

App registration allows users to register custom-developed applications for use within the directory.

Third-party integrated applications connection to services should be disabled unless there is a very clear value and robust security controls are in place. While there are legitimate uses, attackers can grant access from breached accounts to third party applications to exfiltrate data from your tenancy without having to maintain the breached account.

Solution

To remediate using the UI:

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
 - Click to expand Entra ID > Users select Users settings.
 - Set Users can register applications to No.
 - Click Save.

 To remediate using PowerShell:

 - Connect to Microsoft Graph using Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"
 - Run the following commands:
$param = @{ AllowedToCreateApps = "$false" }
 Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $param

Impact:

The implementation of this change will impact both end users and administrators. End users will not be able to integrate third-party applications that they may wish to use. Administrators are likely to receive requests from end users to grant them permission to the necessary third-party applications.

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7(5), 800-53|CM-10, CSCv7|18.4

Plugin: microsoft_azure

Control ID: e93a7c8983ea3880ae311e6a4728faf9b69ca3510f74e3a8fefc02268eb4f99c