What this check looks at
Checks the default user role permission that allows any user to create app registrations.
An app registration is an application’s identity in Entra ID: it can be given credentials (a client secret or a certificate) and permissions to Microsoft Graph and other APIs. By default every member of the tenant can create one, in the Entra admin centre or with PowerShell, and becomes its owner. The same default user permissions also let anyone create a brand-new Entra tenant, which they then run outside the organisation’s control.
The check fails when ordinary users may register applications or create tenants, at high severity when tenant creation is allowed. It passes when both are blocked, and warns or reports it could not check when Microsoft did not return one of the two settings.
User-created app registrations sit outside any inventory: nobody reviews their secrets, which are often set to last a year or two, or the permissions they hold. An attacker who compromises one account can register an app, add a secret and keep access through the app after the password is reset and the sessions revoked. A tenant created by a member of staff holds company data in a directory the organisation cannot see, or recover when they leave.
Why it matters
Every user-created app registration is an unmanaged identity with credentials that never expire by policy and appear on nobody's inventory. It is a durable foothold after a single account compromise.
After a phishing compromise, a careful attacker sets up persistence before the account is noticed. Registering an app and giving it a client secret takes a minute, and the secret then works independently of the user’s password and MFA. When the MSP resets the password and closes the incident, mail keeps leaving through the app until someone audits app registrations.
Shadow tenants are a quieter problem: a manager signs up for a service that creates a new Entra tenant, invites colleagues and stores client data there. When they leave, the organisation has no admin access to it, yet any personal data in it remains the organisation’s responsibility under UK GDPR.
The CIS Microsoft 365 Foundations Benchmark (5.1.2.2 and 5.1.2.3) asks that users cannot register applications or create tenants, the CISA SCuBA baseline (MS.AAD.5.1v1) asks that only administrators register applications, and Cyber Essentials lists app registration by any user among the insecure cloud defaults to turn off. Developers who need it get the Application Developer role.
How to fix it
Where: Entra admin centre → Identity → Users → User settings
Before you start
- Find anyone who registers apps for their job and give them the Application Developer role before switching this off.
Step by step
- Find who registers apps today. In the Microsoft Entra admin centre, go to Entra ID > App registrations > All applications and look at each app’s Owners. In Entra ID > Monitoring & health > Audit logs, filter Activity on Add application over the last 30 days. Note the people who are not administrators but create apps as part of their work.
- Give those people the Application Developer role. Go to Entra ID > Roles & admins, open Application Developer and select Add assignments. Add the people from the previous step (as eligible through PIM if the tenant has Entra ID P2). They can still register applications after the default is turned off.
- Turn off app registration and tenant creation for users. Go to Entra ID > Users > User settings. Set Users can register applications to No and Restrict non-admin users from creating tenants to Yes, then select Save. Or, in Microsoft Graph PowerShell: Connect-MgGraph -Scopes Policy.ReadWrite.Authorization, then Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{ AllowedToCreateApps = $false; AllowedToCreateTenants = $false }.
- Review the app registrations users created. Back in App registrations > All applications, open each app owned by an ordinary user and check Certificates & secrets and API permissions. Delete apps nobody can explain; for apps still in use, add an administrator or the service desk as an owner and record what the app is for.
- Confirm. Reload Entra ID > Users > User settings and check both settings show the new values. Sign in as an ordinary test user and try App registrations > New registration: it should be refused. Re-run the assessment to confirm the finding passes.
What users will notice
Only administrators and people with the Application Developer role can register applications. Most users never do this.
How to confirm it worked
Entra ID, User settings: "Users can register applications" is No.
Frameworks and controls
This check maps to controls in 17 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | Secure configuration |
| Cyber Essentials Plus | Secure configuration |
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | IM-3 Manage application identities securely and automatically |
| Zero Trust | Applications |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 7.2.2 Access is assigned by job function with least privilege |
| NIST SP 800-171 | 3.1.5 Employ the principle of least privilege3.1.2 Limit system access to the types of transactions and functions authorised users may execute |
| CMMC Level 2 | AC.L2-3.1.5 Least PrivilegeAC.L2-3.1.2 Transaction & Function Control |
| ISO 27001:2022 | A.5.15 Access controlA.8.9 Configuration management |
| CISA SCuBA | MS.AAD.5.1v1 Only administrators can register applications |
| CIS M365 | 5.1.2.2 Ensure third party integrated applications are not allowed5.1.2.3 Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes' |
| CIS Controls v8.1 | 4.1 Establish and maintain a secure configuration process (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Restrict who can create applications (Microsoft Learn)