What this check looks at
Finds apps that have not signed in for 90 days, or ever, but still hold permissions to company data.
Apps that were trialled, replaced or abandoned are rarely removed. Their enterprise application stays in Microsoft Entra ID with every permission it was granted, and any client secret or certificate on the app registration stays valid until it expires. Microsoft 365 does not retire unused apps or warn about them.
This check uses the last sign-in date Microsoft records for each app (which needs Entra ID P1 or P2) and flags apps outside Microsoft’s own that can still sign in, hold access to company data (a high-risk delegated scope or a high-privilege application permission) and have not signed in for 90 days, or ever. This check only warns, never fails: it raises a warning when at least one such app exists. It is not applicable on tenants without Entra ID P1 or P2, where the dates are not recorded.
An unused app is an unmonitored way in. If its vendor is breached, its secret leaks from an old script, or someone with rights over the registration adds a new secret, it can be used to read data, and because nobody expects it to be active, its sign-ins attract no attention.
Why it matters
An app nobody uses is an app nobody watches. Its permissions and any secrets behind it stay valid, so it is a quiet way back in for whoever controls it.
A typical case: a 150-person firm trialled a document-management connector eighteen months ago and granted it Files.ReadWrite.All. The trial ended, but the app and its two-year client secret remained. When a former contractor’s laptop holding the configuration file was stolen, the secret still worked and the whole SharePoint estate was readable to whoever held it.
Removing unused apps costs nothing and shortens the list that has to be reviewed every time something goes wrong. Disabling first makes the change safe: if a forgotten process does use the app, it can be switched back on in seconds.
CIS Controls v8 safeguards 2.1 (software inventory) and 5.5 (service accounts), ISO 27001 A.5.9 (inventory) and A.5.18 (access rights), and the NCSC 10 Steps and CAF identity and access management guidance expect unused access to be removed.
How to fix it
Where: Entra admin centre → Identity → Applications → Enterprise applications → Usage and insights
Before you start
- Check the sign-in logs for the app over the last 90 days to confirm nobody uses it.
Step by step
- Confirm the apps are unused. Take the list of apps and their last use from the evidence. In the Microsoft Entra admin centre, Entra ID > Monitoring & health > Sign-in logs, check user sign-ins (interactive and non-interactive) and service principal sign-ins filtered on each app over the period available, and the Usage & insights report under Monitoring & health.
- Check with the client. Confirm with the client that nobody needs each app. The app’s Owners and Users and groups pages give names to ask, and the vendor can say what the app did.
- Disable the apps. Open Entra ID > Enterprise apps > the app > Properties, set Enabled for users to sign in? to No and select Save, or in Microsoft Graph PowerShell run Update-MgServicePrincipal -ServicePrincipalId <object id> -AccountEnabled:$false. Note the date in the client’s change log.
- Remove credentials from in-house apps. If the app is registered in this tenant (it appears under Entra ID > App registrations), open Certificates & secrets and delete its client secrets and certificates, so a leaked copy cannot be used even if the app is re-enabled.
- Delete the apps after a quiet period. After about a month with no complaints, delete the enterprise application (Properties > Delete) and, for in-house apps, the app registration. Deleted applications can be restored for 30 days from the deleted applications list if needed.
- Confirm the apps are disabled or gone. Reopen Enterprise apps and check each listed app is either disabled (Enabled for users to sign in: No) or deleted. The warning clears at the next assessment.
What users will notice
None if the app is genuinely unused.
How to confirm it worked
The listed apps are disabled or deleted in Enterprise applications.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-4 Review and reconcile user access regularly |
| Zero Trust | Applications |
| SOC 2 | CC6.2 User registration, authorisation and removal |
| PCI DSS 4.0.1 | 7.2.4 User accounts and access privileges are reviewed every six months |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.18 Access rightsA.5.9 Inventory of information and other associated assets |
| CIS Controls v8.1 | 2.1 Establish and maintain a software inventory (IG1)5.5 Establish and maintain an inventory of service accounts (IG2) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of dutiesID.AM-02: Inventories of software, services, and systems managed by the organization are maintained |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Review app activity (usage and insights) (Microsoft Learn)