# Inactive applications don’t have highly privileged Microsoft Graph API permissions
Attackers might exploit valid but inactive applications that still have elevated privileges.
Source: https://maester.dev/docs/tests/ZTA.21770
## Overview
Attackers might exploit valid but inactive applications that still have elevated privileges. These applications can be used to gain initial access without raising alarm because they’re legitimate applications. From there, attackers can use the application privileges to plan or execute other attacks. Attackers might also maintain access by manipulating the inactive application, such as by adding credentials. This persistence ensures that even if their primary access method is detected, they can regain access later.
## Remediation
- [Disable privileged service principals](https://learn.microsoft.com/graph/api/serviceprincipal-update?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- Investigate if the application has legitimate use cases
- [If service principal doesn't have legitimate use cases, delete it](https://learn.microsoft.com/graph/api/serviceprincipal-delete?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | High |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | App consent and permissions |
| Area | Applications and workload identities |
| ATT&CK | [T1078.004](/docs/tests?mitre=T1078.004) Cloud Accounts, [T1098.001](/docs/tests?mitre=T1098.001) Additional Cloud Credentials |
| Licence | AAD_PREMIUM |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.