turbot/microsoft365_compliance

Control: 5.1.2.2 Ensure third party integrated applications are not allowed

Description

App registrations allows users to register custom-developed applications for use within the directory.

Third party integrated applications connection to services should be disabled, unless there is a very clear value and robust security controls are in place. While there are legitimate uses, attackers can grant access from breached accounts to third party applications to exfiltrate data from your tenancy without having to maintain the breached account.

Remediation

To prohibit third party integrated applications:

  1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
  2. Click to expand Identity > Users select Users settings.
  3. Set Users can register applications to No.
  4. Click Save.

Default Value

Yes (Users can register applications.)

Usage

Run the control in your terminal:

powerpipe control run microsoft365_compliance.control.cis_v300_5_1_2_2

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run microsoft365_compliance.control.cis_v300_5_1_2_2 --share

SQL

This control uses a named query:

azuread_third_party_application_not_allowed

Tags