Loading controls...
Control: 1.14 Ensure That 'Users Can Register Applications' Is Set to 'No'
Description
Require administrators or appropriately delegated users to register third-party applications.
It is recommended to only allow an administrator to register custom-developed applications. This ensures that the application undergoes a formal security review and approval process prior to exposing Azure Active Directory data. Certain users like developers or other high-request users may also be delegated permissions to prevent them from waiting on an administrative user. Your organization should review your policies and decide your needs.
Remediation
From Azure Portal
- From Azure Home select the Portal Menu.
- Select
Azure Active Directory
. - Select
Users
. - Select
User settings
. - Set
Users can register applications
toNo
.
From Powershell
Connect-MsolServiceSet-MsolCompanyInformation -UsersPermissionToCreateLOBAppsEnabled $False
Default Value
By default, Users can register applications
is set to "Yes".
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v200_1_14
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v200_1_14 --share
SQL
This control uses a named query:
iam_user_not_allowed_to_register_application