APP-12: Restrict User App Registration

Overview

By default, Microsoft Entra ID lets any user register applications in the tenant. When app registration is open to everyone, attackers and unmanaged users can create app registrations to request OAuth permissions, establish persistence, or stage illicit consent attacks. Every user-created application is a potential entry point that sits outside your review process.

Restricting application registration to administrators keeps the application attack surface governed. New applications enter through people who are accountable for them, which makes permission review, ownership, and lifecycle tracking possible.

This control assesses a single tenant setting. The expected state is:

• Non-admin users cannot register applications.
• App registration is restricted to administrators.
• authorizationPolicy.defaultUserRolePermissions.allowedToCreateApps is false.

Control ID: APP-12 Category: Workload Identity & Applications Baseline Level: Level 1 (Recommended Secure) Severity: Medium License Required: None. Microsoft Entra ID (any tier).

This is a detect-only, advisory control. TrueConfig reads the authorization policy and reports whether allowedToCreateApps is set to false. It does not change the setting for you. The fix is a one-time toggle in the Entra admin center or a single Graph update, described below. This control aligns with CIS Microsoft Entra ID Foundations Benchmark 5.1.2.2.

Prerequisites

Required Roles

• Global Administrator - Required to change tenant-wide user settings and the authorization policy

Required Licenses

• Microsoft Entra ID, any tier

Pre-Configuration Requirements

1. Confirm who legitimately needs to register applications. Developers who currently self-register apps will need an alternative path (an admin registers on their behalf, or you delegate the Application Developer role).
2. Review existing user-created applications before locking down, so you understand what was created under the open setting.

Time Estimate

Step-by-Step Instructions

Step 1: Check the Current Setting

Via the Entra admin center

1. Navigate to the Microsoft Entra admin center (https://entra.microsoft.com).
2. Go to Identity > Users > User settings.
3. Locate Users can register applications and note its current value.

Via Microsoft Graph PowerShell

Connect-MgGraph -Scopes "Policy.Read.All"
(Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions | Select-Object AllowedToCreateApps

If AllowedToCreateApps returns True, any user can register applications and this control is flagged.

Step 2: Restrict App Registration to Administrators

Via the Entra admin center

1. In Identity > Users > User settings, set Users can register applications to No.
2. Click Save.

Via Microsoft Graph PowerShell

Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"

Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{
    AllowedToCreateApps = $false
}

Step 3: Establish a Registration Path for Developers

Locking the setting to No does not mean developers lose all ability to create apps. Choose a controlled path:

• Admin-registered apps. Developers request an app registration; an administrator creates it and assigns the developer as owner.
• Delegated Application Developer role. Assign the built-in Application Developer role to trusted users. It permits app registration even when the tenant-wide setting is No, while keeping the default blocked for everyone else.

Document whichever path you choose so the change does not surprise development teams.

Step 4: Confirm the Change

Re-run the Graph check from Step 1 and verify AllowedToCreateApps now returns False. Optionally, test with a standard (non-admin, non-Application-Developer) account to confirm the New registration action is blocked.

Verification Checklist

• The current value of allowedToCreateApps has been reviewed.
• Existing user-created applications have been reviewed for ownership and permissions.
• Users can register applications is set to No (or allowedToCreateApps is false).
• A registration path exists for developers (admin-registered or delegated Application Developer role).
• The new process is documented and communicated.
• TrueConfig reports APP-12 as compliant.

Troubleshooting

Issue: Developers can still register applications after the change

Cause: They hold the Application Developer role or an administrative role that permits registration.

Solution:

1. Review role assignments for users who can still register.
2. This is expected if you intentionally delegated the Application Developer role. If not, remove the role.
3. Global Administrators and Application Administrators can always register apps by design.

Issue: A team's automation broke because it self-registered apps

Cause: A pipeline or script relied on a standard user account being able to create app registrations.

Solution:

1. Move that automation to a service principal with the appropriate directory role, or route registration through an admin-approved process.
2. Avoid re-enabling tenant-wide user registration to fix a single workflow.

Issue: The setting reverts or does not appear to save

Cause: Directory replication delay, or the change was made without the required role.

Solution:

1. Confirm you are signed in as a Global Administrator.
2. Wait a few minutes and re-check via Graph, which reads the authoritative authorization policy.

Cost Considerations

There is no licensing cost for this control. It uses a built-in tenant setting available on every Microsoft Entra ID tier.

The cost is operational and small:

• Slight process overhead. Developers who previously self-registered apps now route through an admin or a delegated role. This is a minor workflow change, not a blocker.
• Avoided cost. Open app registration is a known persistence and consent-attack vector. Closing it removes a low-effort foothold for attackers and reduces the volume of unreviewed, unowned applications that accumulate over time.
• Detect-only in TrueConfig. TrueConfig continuously monitors the setting and re-flags it if it drifts back to open, so the one-time fix stays enforced without manual re-checks.

Related Controls

• APP-08: Restrict User Application Consent (block users from consenting to app permissions)
• APP-01: Application Ownership for Apps with Credentials (assign accountable owners)
• GOV-09: Restrict Tenant Creation (a related authorization-policy hardening)

Related Resources

• Restrict who can create applications
• authorizationPolicy resource type
• CIS Microsoft Entra ID Foundations Benchmark