# Require explicit assignment of high-privilege first-party Entra Apps

This test checks if any of the following high-privilege, first-party Microsoft service principals allow sign-in from any user instead of requiring…

Source: https://maester.dev/docs/tests/MT.1186

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/bakkerjan" title="Jan Bakker · Original author"><img src="https://github.com/BakkerJan.png" alt="Jan Bakker" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/bakkerjan">Jan Bakker</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Applications · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1186
```

## Overview

This test checks if any of the following high-privilege, first-party Microsoft service principals allow sign-in from any user instead of requiring explicit assignment:

- Microsoft Azure PowerShell
- Microsoft Azure CLI and Azure Developer CLI (`azd`) - both currently use the same application ID
- Microsoft Graph Command Line Tools (used by the Microsoft Graph PowerShell SDK and Microsoft Graph CLI)
- Graph Explorer
- Azure Active Directory PowerShell (legacy)
- Microsoft Teams PowerShell Cmdlets (used by the `MicrosoftTeams` module)
- Microsoft Exchange Online PowerShell (used by the `ExchangeOnlineManagement` module)
- Microsoft SharePoint Online Management Shell
- Power Platform CLI (`pac`)

These apps are pre-consented in most tenants and carry broad delegated permissions to Microsoft Graph, Azure Resource Manager, or their respective workload (Exchange Online, SharePoint Online, Teams, Power Platform). Left open to all users, any compromised or malicious account can use them, without any further consent prompt, to enumerate directory data and resources, or to administer that workload directly - a common first step in privilege escalation and data exfiltration. It is recommended to set 'Assignment required?' to Yes for these applications and explicitly assign only the users or groups who need them.

A first-party application can still be used even when its service principal is not visible in the tenant. A missing service principal is therefore reported as needing attention because the assignment requirement cannot be enforced until the service principal is created.

#### Remediation action

1. Review the application's sign-in logs to identify the users who need access.
2. If a flagged application is reported as **Service principal missing**, create it with Microsoft Graph PowerShell:

   ```powershell
   Connect-MgGraph -Scopes 'Application.ReadWrite.All'
   $appId = '<AppId>'
   $sp = Get-MgServicePrincipal -Filter "appId eq '$appId'"
   if (-not $sp) {
       $sp = New-MgServicePrincipal -AppId $appId
   }
   ```

3. Assign the approved users or groups under **Users and groups**.
4. Set **Assignment required?** to **Yes** under **Properties**, or use Microsoft Graph PowerShell:

   ```powershell
   Update-MgServicePrincipal -ServicePrincipalId $sp.Id -AppRoleAssignmentRequired:$true
   ```

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1186 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Applications |
| Area | Applications and workload identities |
| Resource type | ServicePrincipal |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1059.009 Cloud API, T1087.004 Cloud Account, T1526 Cloud Service Discovery |
| Supports controls | nist-800-53-r5:AC-3, nist-800-53-r5:AC-6 |
| PowerShell test | [Test-MtHighPrivilegeServicePrincipalsForAllUsers](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1186.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1186.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1186.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1186.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1186.md)