Require explicit assignment of Third Party Entra Apps
MT.1075MediumEntra IDApplications
Part of Maester · Entra ID · Applications · All checks
Invoke-Maester -TestId MT.1075Overview
Section titled “Overview”This test checks if you have any third party service principals that are open to all users. It is recommended to set ‘Assignment required?’ to Yes for all Third Party apps.
Remediation action
Section titled “Remediation action”Open all app service principals below and set ‘Assignment required?’ to Yes. Assign users under ‘Users and groups’ to provide them with explicit access. If desired, use the audit logs per SPN to determine who was using the application before locking them down.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1075 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Applications |
| Area | Applications and workload identities |
| Resource type | ServicePrincipal |
| User impact | Medium |
| Implementation cost | High |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-3, nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtServicePrincipalsForAllUsers |
| Services | Graph |
| Long running | Yes |
Source
Section titled “Source”- Test:
tests/maester/entra/Test.MT.1075.ps1 - Documentation:
tests/maester/entra/Test.MT.1075.md