Restrict User App Registration
Workload Identity & Applications control for Microsoft 365 and Entra ID
Why This Control Matters
When any user can register applications, attackers and unmanaged users can create app registrations to request OAuth permissions or establish persistence. Restricting registration to administrators keeps the application attack surface governed.
Expected State
When this control is compliant, your tenant should meet these criteria:
- 1Non-admin users cannot register applications
- 2App registration is restricted to administrators
- 3authorizationPolicy.defaultUserRolePermissions.allowedToCreateApps is false
Enforcement
Alerts on deviations but does not make changes
TrueConfig can apply the authorization-policy fix in one click (Graph PATCH to authorizationPolicy setting Users can register applications = No). The manual alternative is Entra admin center > User settings > Users can register applications = No.
Ready to implement this control?
TrueConfig continuously monitors your Microsoft 365 tenant for compliance with this and 50+ other security controls.