APP-06: Third-Party Enterprise App Permissions

APP-06 is a security control that third-party enterprise apps are applications from external vendors that you consented to but do not control. these apps pose supply chain risk - a compromised vendor could access your tenant data. review vendor security certifications and limit permissions to minimum necessary. It requires that third-party enterprise apps with elevated permissions are identified and reviewed and external vendor apps with directory.readwrite.all, mail.readwrite.all are flagged, each third-party app with elevated permissions has documented vendor assessment, quarterly review of third-party app permissions is conducted.

Third-party enterprise apps are applications from external vendors that you consented to but do not control. These apps pose supply chain risk - a compromised vendor could access your tenant data. Review vendor security certifications and limit permissions to minimum necessary.

APP-06 requires manual implementation. Review flagged third-party applications, verify vendor security posture, and document justification

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

APP-06 is included in the Enhanced Security baseline (Level 2). This level adds stricter controls for security-conscious organizations.