(L1) Ensure users cannot register applications

Contributed by Benjamin Metz with -MynsterAll contributors →

Part of CIS · Entra ID · User and directory settings · All checks

Run this check

Invoke-Maester -TestId CIS.M365.5.1.2.2

Overview

5.1.2.2 (L1) Ensure users cannot register applications

This setting controls whether standard users can register applications in the Microsoft Entra ID directory. When enabled, any user can create app registrations, which function as identity objects for applications.

Rationale

Allowing standard users to create app registrations expands the tenant’s attack surface. A compromised account or malicious insider could create a rogue app registration to establish a persistent OAuth client, facilitate token theft, or impersonate a legitimate application. Restricting app registration to privileged roles ensures that new application identities in the directory are subject to administrative review and approval before they can be granted permissions to organizational resources.

Impact

End users will no longer be able to register applications independently, including both third-party integrations and custom applications. Developers and IT staff who create app registrations as part of normal workflows will be affected and will need to submit registration requests to a privileged administrator (e.g., Application Administrator or Cloud Application Administrator). Organizations should establish a formal request and approval process before implementing this change to avoid workflow disruption.

Remediation action

1. Navigate to Microsoft 365 Entra admin center.
2. Click to expand Entra ID > Users select Users settings.
3. Set Users can register applications to No.
4. Click Save.

PowerShell

1. Connect to Microsoft Graph using Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"
2. Run the following commands:

$param = @{ AllowedToCreateApps = $false }
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $param

Related links

• Microsoft 365 Entra admin center
• How and why applications are added to Microsoft Entra ID
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 197

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.5.1.2.2
Severity	Medium
Suite	CIS
Product	Entra ID
Feature	User and directory settings
Area	Applications and workload identities
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1098.001 Additional Cloud Credentials, T1528 Steal Application Access Token
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.2.2
Benchmark level	L1
Benchmark profiles	E3 Level 1, E5 Level 1
Supports controls	cis-m365:5.1.2.2, nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5
PowerShell test	Test-MtCisThirdPartyApplicationsDisallowed
Services	Graph

Source

• Test: tests/cis/Test.CIS.M365.5.1.2.2.ps1
• Documentation: tests/cis/Test.CIS.M365.5.1.2.2.md