# Creating new applications and service principals is restricted to privileged users
If nonprivileged users can create applications and service principals, these accounts might be misconfigured or be granted more permissions than…
Source: https://maester.dev/docs/tests/ZTA.21807
:::note[Maester checks this too]
[CISA.MS.AAD.5.1](/docs/tests/CISA.MS.AAD.5.1) (Only administrators SHALL be allowed to register applications.), [CIS.M365.5.1.2.2](/docs/tests/CIS.M365.5.1.2.2) (Ensure users cannot register applications), [EIDSCA.AP10](/docs/tests/EIDSCA.AP10) (Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.) check the same setting. Running both reports it twice.
:::
## Overview
If nonprivileged users can create applications and service principals, these accounts might be misconfigured or be granted more permissions than necessary, creating new vectors for attackers to gain initial access. Attackers can exploit these accounts to establish valid credentials in the environment and bypass some security controls.
If these nonprivileged accounts are mistakenly granted elevated application owner permissions, attackers can use them to move from a lower level of access to a more privileged level of access. Attackers who compromise nonprivileged accounts might add their own credentials or change the permissions associated with the applications created by the nonprivileged users to ensure they can continue to access the environment undetected.
Attackers can use service principals to blend in with legitimate system processes and activities. Because service principals often perform automated tasks, malicious activities carried out under these accounts might not be flagged as suspicious.
## Remediation
- [Block nonprivileged users from creating apps](https://learn.microsoft.com/entra/identity/role-based-access-control/delegate-app-roles?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Identity |
| Category | Application management |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | User and directory settings |
| Area | Applications and workload identities |
| ATT&CK | [T1098.001](/docs/tests?mitre=T1098.001) Additional Cloud Credentials, [T1528](/docs/tests?mitre=T1528) Steal Application Access Token |
| Licence | P1 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.