Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'
Checks the Microsoft Entra ID authorization policy setting `allowed_to_create_apps`, which governs whether users can register applications. Application creation is expected to be limited to administrators or explicitly delegated roles.
Permitting default users to register apps enables unvetted service principals, consent phishing, and over-privileged API access, threatening data confidentiality and integrity. Adversaries can persist with app credentials, exfiltrate mail/files, and perform lateral movement using rogue permissions.
What this control checks
The Users can register applications setting must be set to No
Audit evidence
Evidence that deployed resources meet this control: Prowler check entra_policy_ensure_default_user_cannot_create_apps (prowler azure --checks entra_policy_ensure_default_user_cannot_create_apps); PowerPipe control azure_compliance.control.iam_user_not_allowed_to_register_application.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.5.15 (Access Control), A.5.18 (Access Rights), A.5.2 (Roles and Responsibilities) and 1 more clause.
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.a (assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;), 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...), 11.3.2.c (individualise and restrict system administration privileges to the highest extent possible,) and 4 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.2 Information security roles and responsibilities
- A.5.15 Access control
- A.5.18 Access rights
- A.8.2 Privileged access rights
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 6.14 Ensure that 'Users can register applications' is set to 'No'
- 5.14 Ensure that 'Users can register applications' is set to 'No'
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- 1.14 Ensure That 'Users Can Register Applications' Is Set to 'No'
- 1.14 Ensure That 'Users Can Register Applications' Is Set to 'No'
- 1.13 Ensure That 'Users Can Register Applications' Is Set to 'No'
- 2.14 Ensure That 'Users Can Register Applications' Is Set to 'No'
- 164.308(a)(4)(ii)(C) Access establishment and modification
Related controls
- Azure subscriptions should limit owners to 3
- Microsoft Entra ID tenants should limit Global Administrators to fewer than 5
- Microsoft Admin Portals should require multifactor authentication
- Microsoft Entra ID policies should have 'Require Multifactor Authentication to register or join devices with Microsoft Entra' set to 'Yes'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_user_not_allowed_to_register_application - Powerpipe Control:
azure_compliance.control.iam_user_not_allowed_to_register_application - Prowler Check:
entra_policy_ensure_default_user_cannot_create_apps
Last reviewed: 2026-10-13