App registrations with highly privileged directory roles should not have owners
Part of Maester · Defender · Exposure Management · All checks
Invoke-Maester -TestId MT.1078Overview
Section titled “Overview”Owners with lower privilege than the application should be removed from ownership.
Microsoft also mentions this risk of elevation of privilege over what the owner has access to as a user.
Those delegations can be identified by the Tier breach flag in the test results.
But even owners with the same or higher privilege should not be delegated ownership because of missing support for just-in-time access (eligibility in PIM), enforced step-up authentication (authentication context by PIM in Entra ID roles), or assignment via group membership.
Side Note: Currently, due to limitations of XSPM data, only assignments on application objects are identified.
How to fix
Section titled “How to fix”Remove ownership and replace it (if necessary) by using object-level role assignments, and avoid any lateral movement paths by delegating to administrators with lower privilege classification (tier breach).
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1078 |
| Severity | Medium |
| Suite | Maester |
| Product | Defender |
| Related products | Entra ID |
| Feature | Exposure Management |
| Area | Applications and workload identities |
| Resource type | Application |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1098.001 Additional Cloud Credentials |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtXspmAppRegWithPrivilegedRolesAndOwners |
| Services | Graph |
| Long running | Yes |
Source
Section titled “Source”- Test:
tests/maester/xspm/Test.MT.1078.ps1 - Documentation:
tests/maester/xspm/Test.MT.1078.md