Loading controls...
Control: 1.13 Ensure That 'Users Can Register Applications' Is Set to 'No'
Description
Require administrators or appropriately delegated users to register third-party applications.
It is recommended to only allow an administrator to register custom-developed applications. This ensures that the application undergoes a formal security review and approval process prior to exposing Microsoft Entra ID data. Certain users like developers or other high-request users may also be delegated permissions to prevent them from waiting on an administrative user. Your organization should review your policies and decide your needs.
Remediation
From Azure Portal
- From Azure Home select the Portal Menu.
- Select
Microsoft Entra ID
. - Select
Users
. - Select
User settings
. - Set
Users can register applications
toNo
.
From Powershell
Connect-MsolServiceSet-MsolCompanyInformation -UsersPermissionToCreateLOBAppsEnabled $False
Default Value
By default, Users can register applications
is set to "Yes".
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v210_1_13
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v210_1_13 --share
SQL
This control uses a named query:
iam_user_not_allowed_to_register_application