Non-admin users cannot register applications

Check ID: entra_policy_ensure_default_user_cannot_create_apps
Provider: Azure
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

What this check verifies

Microsoft Entra authorization policy controls whether default users can create application registrations via allowed_to_create_apps. App creation is expected to be limited to administrators or explicitly delegated roles.

Risk

Permitting default users to register apps enables unvetted service principals, consent phishing, and over-privileged API access, threatening data confidentiality and integrity. Adversaries can persist with app credentials, exfiltrate mail/files, and perform lateral movement using rogue permissions.

Recommendation

Apply least privilege: restrict app registration to admins or delegated roles; set Users can register applications to No. Use the Application Developer role for exceptions, require admin consent workflows, routinely review app/service principal permissions, and audit changes for defense in depth.

Remediation

CLI
Terraform
Dashboard steps

az rest --method PATCH --url https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy --body '{"defaultUserRolePermissions":{"allowedToCreateApps":false}}'

resource "azuread_authorization_policy" "<example_resource_name>" {
  default_user_role_permissions {
    allowed_to_create_apps = false # Critical: disables application registration for non-privileged users
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_policy_ensure_default_user_cannot_create_apps. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Non-privileged users cannot create security groups Non-admin users cannot create tenants

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires