# Require explicit assignment of Third Party Entra Apps

This test checks if you have any third party service principals that are open to all users.

Source: https://maester.dev/docs/tests/MT.1075

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jflieben" title="Jos Lieben · Original author"><img src="https://github.com/jflieben.png" alt="Jos Lieben" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jflieben">Jos Lieben</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Applications · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1075
```

## Overview

This test checks if you have any third party service principals that are open to all users. It is recommended to set 'Assignment required?' to Yes for all Third Party apps.

#### Remediation action

Open all app service principals below and set 'Assignment required?' to Yes. Assign users under 'Users and groups' to provide them with explicit access. If desired, use the audit logs per SPN to determine who was using the application before locking them down.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1075 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Applications |
| Area | Applications and workload identities |
| Resource type | ServicePrincipal |
| User impact | Medium |
| Implementation cost | High |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-3, nist-800-53-r5:AC-6 |
| PowerShell test | [Test-MtServicePrincipalsForAllUsers](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1075.ps1) |
| Services | Graph |
| Long running | Yes |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1075.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1075.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1075.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1075.md)