APP-03: Internal App Registration Permissions

APP-03 is a security control that internal app registrations are applications you created and control. while you own the code, misconfigured permissions can expose excessive access. regular review ensures your own apps only have necessary permissions. It requires that internal app registrations with high-privilege graph permissions are documented and reviewed quarterly and permissions like mail.readwrite.all, directory.readwrite.all, and rolemanagement.readwrite.directory are flagged, each internal app with elevated permissions has documented business justification.

Internal app registrations are applications you created and control. While you own the code, misconfigured permissions can expose excessive access. Regular review ensures your own apps only have necessary permissions.

TrueConfig provides one-click remediation for APP-03. TrueConfig can revoke a flagged high-risk Graph permission in one click (revoke_app_permission). The manual alternative is reviewing flagged internal applications and removing unnecessary permissions.

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

APP-03 is included in the Enhanced Security baseline (Level 2). This level adds stricter controls for security-conscious organizations.