Ensure That 'Users Can Register Applications' Is Set to 'No'
entra_policy_ensure_default_user_cannot_create_apps
Require administrators or appropriately delegated users to register third-party applications.
Risk
It is recommended to only allow an administrator to register custom-developed applications. This ensures that the application undergoes a formal security review and approval process prior to exposing Azure Active Directory data. Certain users like developers or other high-request users may also be delegated permissions to prevent them from waiting on an administrative user. Your organization should review your policies and decide your needs.
Run this check with Prowler CLI
prowler azure --checks entra_policy_ensure_default_user_cannot_create_apps
Remediation
https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActiveDirectory/users-can-register-applications.html
1. From Azure Home select the Portal Menu 2. Select Azure Active Directory 3. Select Users 4. Select User settings 5. Ensure that Users can register applications is set to No
Source Code
Resource Type
#microsoft.graph.authorizationPolicy