Back to Checks
m365

Authorization policy disallows app creation by non-admin users

entra_thirdparty_integrated_apps_not_allowed
Service: entraSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra authorization policy restricts registration of third-party applications, verifying that non-admin users cannot create app registrations and that only administrators or explicitly delegated roles can add integrated apps.

Prowler logoProwlerprowler-provider-m365

Risk

Allowing users to create apps enables consent phishing and uncontrolled service principals with long-lived secrets, risking data exfiltration via over-privileged API access, privilege escalation through abused app permissions, and tenant persistence. This degrades confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_thirdparty_integrated_apps_not_allowed

Recommendation

Restrict app registration to administrators or narrowly scoped delegated roles, following least privilege and separation of duties. Require admin consent and formal review for external integrations, disable broad user consent, and audit app creations and permissions to enforce defense in depth.

Remediation

CLI

Invoke-MgGraphRequest -Method PATCH -Uri 'https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy' -Body '{"defaultUserRolePermissions":{"allowedToCreateApps":false}}' -ContentType 'application/json'

Other

1Sign in to the Microsoft Entra admin center
2Go to Identity > Users > User settings
3Set "Users can register applications" to "No"
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_thirdparty_integrated_apps_not_allowed(Check):
    """Check if third-party integrated apps are not allowed for non-admin users in Entra.

    This check verifies that non-admin users are not allowed to create third-party apps.
    If the policy allows app creation, the check fails.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check to ensure third-party integrated apps are not allowed for non-admin users.

        This method checks if the authorization policy allows non-admin users to create apps.
        If the policy allows app creation, the check fails. Otherwise, the check passes.

        Returns:
            List[CheckReportM365]: A list containing the result of the check for app creation policy.
        """
        findings = []
        auth_policy = entra_client.authorization_policy

        if auth_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=auth_policy if auth_policy else {},
                resource_name=(
                    auth_policy.name if auth_policy else "Authorization Policy"
                ),
                resource_id=auth_policy.id if auth_policy else "authorizationPolicy",
            )
            if getattr(
                auth_policy, "default_user_role_permissions", None
            ) and not getattr(
                auth_policy.default_user_role_permissions,
                "allowed_to_create_apps",
                True,
            ):
                report.status = "PASS"
                report.status_extended = "App creation is disabled for non-admin users."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    "App creation is not disabled for non-admin users."
                )

            findings.append(report)

        return findings

References