Microsoft Entra tenant where regular users can register applications

This setting is rated high severity because it increases the risk of privilege escalation and persistence, allowing attackers to expand their reach within the environment. An attacker can use a custom-developed application to access data in the tenant on behalf of a user without administrative oversight.

An attacker can exploit this setting by developing and registering a malicious application, which is then granted permissions to access data in the tenant on behalf of a user. This allows the threat actor to expand their reach within the environment and potentially gain persistence.

Cayosoft Guardian continuously monitors the settings in your Microsoft Entra environment, detecting when this setting is enabled. When found, Guardian flags it as a security issue so administrators are aware of the potential risk.

Cayosoft Guardian alerts administrators to disable this setting in the Microsoft Entra admin center, ensuring only approved and reviewed applications are allowed to access data in the tenant. This reduces the potential for privilege escalation and persistence.