Workload Identity & Applications
Application registrations and service principals
Assign Owners to All Applications
Unowned applications become orphaned and unmanaged. When security issues arise or credentials need rotation, there is no accountable party. Orphaned apps are a common persistence mechanism for attackers.
Enforce Application Credential Expiration
Long-lived or non-expiring secrets are a supply chain attack risk. If a secret is leaked, it remains valid indefinitely. Rotating credentials limits the window of exposure from compromised secrets.
Service Principal Credential Hygiene
Service principals are the #1 attack vector for M365 supply chain compromises. Long-lived credentials on service principals (like those used in SolarWinds, Midnight Blizzard) bypass MFA entirely and provide persistent access.
Restrict User Application Consent
OAuth phishing attacks trick users into granting malicious apps access to their data. By blocking user consent, you force all app permission requests through admin review, stopping this attack vector.
Internal App Registration Permissions
Internal app registrations are applications you created and control. While you own the code, misconfigured permissions can expose excessive access. Regular review ensures your own apps only have necessary permissions.
Enable Admin Consent Workflow
Without admin consent workflow, any user can grant an OAuth app access to their data. Attackers use illicit consent grant attacks to trick users into granting malicious apps access. Admin approval stops this attack vector.
Third-Party Enterprise App Permissions
Third-party enterprise apps are applications from external vendors that you consented to but do not control. These apps pose supply chain risk - a compromised vendor could access your tenant data. Review vendor security certifications and limit permissions to minimum necessary.
Identify Unused Service Principals
Dormant service principals with valid credentials are invisible persistence mechanisms. Attackers can use forgotten apps with stale credentials to maintain access long after initial compromise detection.
Ready to implement workload identity & applications controls?
TrueConfig continuously monitors your Microsoft 365 tenant and helps you maintain compliance with these security controls.