Check ID: entra_thirdparty_integrated_apps_not_allowed
Provider: Microsoft 365
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra authorization policy restricts registration of third-party applications, verifying that non-admin users cannot create app registrations and that only administrators or explicitly delegated roles can add integrated apps.

​
Risk

Allowing users to create apps enables consent phishing and uncontrolled service principals with long-lived secrets, risking data exfiltration via over-privileged API access, privilege escalation through abused app permissions, and tenant persistence. This degrades confidentiality, integrity, and availability.

​
Recommendation

Restrict app registration to administrators or narrowly scoped delegated roles, following least privilege and separation of duties. Require admin consent and formal review for external integrations, disable broad user consent, and audit app creations and permissions to enforce defense in depth.

​
Remediation

Invoke-MgGraphRequest -Method PATCH -Uri 'https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy' -Body '{"defaultUserRolePermissions":{"allowedToCreateApps":false}}' -ContentType 'application/json'

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_thirdparty_integrated_apps_not_allowed. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks