Back to Checks
azure

Tenant does not allow non-admin users to register applications

entra_policy_ensure_default_user_cannot_create_apps
Service: entraSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra authorization policy controls whether default users can create application registrations via allowed_to_create_apps. App creation is expected to be limited to administrators or explicitly delegated roles.

Prowler logoProwlerprowler-provider-azure

Risk

Permitting default users to register apps enables unvetted service principals, consent phishing, and over-privileged API access, threatening data confidentiality and integrity. Adversaries can persist with app credentials, exfiltrate mail/files, and perform lateral movement using rogue permissions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_policy_ensure_default_user_cannot_create_apps

Recommendation

Apply least privilege: restrict app registration to admins or delegated roles; set Users can register applications to No. Use the Application Developer role for exceptions, require admin consent workflows, routinely review app/service principal permissions, and audit changes for defense in depth.

Remediation

CLI

az rest --method PATCH --url https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy --body '{"defaultUserRolePermissions":{"allowedToCreateApps":false}}'

Terraform

resource "azuread_authorization_policy" "<example_resource_name>" {
  default_user_role_permissions {
    allowed_to_create_apps = false # Critical: disables application registration for non-privileged users
  }
}

Other

1Sign in to the Microsoft Entra admin center
2Go to Microsoft Entra ID > Users > User settings
3Set "Users can register applications" to "No"
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_policy_ensure_default_user_cannot_create_apps(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for tenant_domain, auth_policy in entra_client.authorization_policy.items():
            report = Check_Report_Azure(metadata=self.metadata(), resource=auth_policy)
            report.subscription = f"Tenant: {tenant_domain}"
            report.resource_name = getattr(auth_policy, "name", "Authorization Policy")
            report.resource_id = auth_policy.id
            report.status = "FAIL"
            report.status_extended = "App creation is not disabled for non-admin users."

            if getattr(
                auth_policy, "default_user_role_permissions", None
            ) and not getattr(
                auth_policy.default_user_role_permissions,
                "allowed_to_create_apps",
                True,
            ):
                report.status = "PASS"
                report.status_extended = "App creation is disabled for non-admin users."

            findings.append(report)

        return findings

References