All App registration owners should have MFA registered

Contributed by Marcel N.All contributors →

Part of Maester · Entra ID · Authentication methods · All checks

Run this check

Invoke-Maester -TestId MT.1063

Overview

This test checks if all owners of app registrations have Multi-Factor Authentication (MFA) registered. App registration owners without MFA pose a significant security risk as credential stuffing attacks can lead to privileged access and potential privilege escalation or data loss.

Why This Matters

App registration owners have powerful permissions that attackers actively target:

• Credential Stuffing Risk: Without MFA, compromised passwords from data breaches provide immediate access
• Privileged App Access: Owners can modify app permissions, certificates, and redirect URIs
• Privilege Escalation: Compromised owners can grant themselves or malicious apps excessive permissions
• Lateral Movement: Access to one app registration can be leveraged to compromise other resources

Attack Scenario

1. Initial Compromise: Attacker uses leaked credentials to access owner account (no MFA protection)
2. App Manipulation: Attacker modifies app registration to add malicious redirect URIs, certificates or secrets
3. Broader Access: Compromised app is used to access sensitive data across the organization or to escalate privileges

Remediation action

Register MFA for all app registration owners listed. Use Conditional Access policies to enforce MFA for all application owners.

Details

Every attribute of this check

Field	Value
Test ID	MT.1063
Severity	High
Suite	Maester
Product	Entra ID
Feature	Authentication methods
Area	Authentication
Resource type	User
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts, T1098.001 Additional Cloud Credentials, T1110.004 Credential Stuffing
Supports controls	nist-800-53-r5:IA-2(1), nist-800-53-r5:AC-6
PowerShell test	Test-MtAppRegistrationOwnersWithoutMFA
Services	Graph
Long running	Yes

Source

• Test: tests/maester/entra/Test.MT.1063.ps1
• Documentation: tests/maester/entra/Test.MT.1063.md