CIS.M365.5.1.2.2: Ensure users cannot register applications


ID	`CIS.M365.5.1.2.2`
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Entra ID
Feature	User and directory settings
Security area	Applications and workload identities
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, `5.1.2.2` (L1, E3 Level 1, E5 Level 1)
Framework controls	`cis-m365:5.1.2.2` `nist-800-53-r5:AC-6(10)` Least Privilege \| Prohibit Non-privileged Users from Executing Privileged Functions `nist-800-53-r5:CM-5` Access Restrictions for Change
MITRE ATT&CK	T1098.001, T1528
Reads from	Microsoft Graph

What this checks and how to fix it

5.1.2.2 (L1) Ensure users cannot register applications

This setting controls whether standard users can register applications in the Microsoft Entra ID directory. When enabled, any user can create app registrations, which function as identity objects for applications.

Rationale

Allowing standard users to create app registrations expands the tenant’s attack surface. A compromised account or malicious insider could create a rogue app registration to establish a persistent OAuth client, facilitate token theft, or impersonate a legitimate application. Restricting app registration to privileged roles ensures that new application identities in the directory are subject to administrative review and approval before they can be granted permissions to organizational resources.

Impact

End users will no longer be able to register applications independently, including both third-party integrations and custom applications. Developers and IT staff who create app registrations as part of normal workflows will be affected and will need to submit registration requests to a privileged administrator (e.g., Application Administrator or Cloud Application Administrator). Organizations should establish a formal request and approval process before implementing this change to avoid workflow disruption.

Remediation action

Navigate to Microsoft 365 Entra admin center.
Click to expand Entra ID > Users select Users settings.
Set Users can register applications to No.
Click Save.

PowerShell

Connect to Microsoft Graph using Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"
Run the following commands:

$param = @{ AllowedToCreateApps = $false }
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $param

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: oed-metzb; contributors: Mynster9361. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).