Only administrators SHALL be allowed to register applications

Contributed by Michael Soule with Merill FernandoAll contributors →

Part of CISA · Entra ID · User and directory settings · All checks

Run this check

Invoke-Maester -TestId CISA.MS.AAD.5.1

Overview

Only administrators SHALL be allowed to register applications.

Rationale: Application access for the tenant presents a heightened security risk compared to interactive user access because applications are typically not subject to critical security protections, such as MFA policies. Reduce risk of unauthorized users installing malicious applications into the tenant by ensuring that only specific privileged users can register applications.

Remediation action:

1. In Entra, under Identity and Users, select User settings.
2. For Users can register applications, select No.
3. Click Save.

Related links

• Entra admin center - User settings
• CISA Application Registration & Consent - MS.AAD.5.1v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.AAD.5.1
Severity	Medium
Suite	CISA
Product	Entra ID
Feature	User and directory settings
Area	Applications and workload identities
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1098.001 Additional Cloud Credentials, T1098.003 Additional Cloud Roles, T1528 Steal Application Access Token
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.5.1
Criticality	SHALL
Upstream requirement	MS.AAD.5.1v1
Supports controls	cisa-scuba:MS.AAD.5.1, nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5
PowerShell test	Test-MtCisaAppRegistration
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.5.1.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.5.1.md