Skip to main content
Version: 2.1.0

MT.1077 - App registrations with privileged API permissions should not have owners

Overview​

Especially, owners with lower privilege than the application should be removed from ownership. Microsoft also mentions this risk of elevation of privilege over what the owner has access to as a user. Those delegations can be identified by the Tier breach flag in the test results.

But even owners with the same or higher privilege should not be delegated ownership because of missing support for just-in-time access (eligibility in PIM), enforced step-up authentication (authentication context by PIM in Entra ID roles), or assignment via group membership.

Side Note: Currently, due to limitations of XSPM data, only assignments on application objects are identified.

How to fix​

Remove ownership and replace it (if necessary) by using object-level role assignments, and avoid any lateral movement paths by delegating to administrators with lower privilege classification (tier breach).

Test Metadata​

FieldValue
Test IDMT.1077
SeverityMedium
SuiteMaester
CategoryPrivileged
PowerShell testTest-MtXspmAppRegWithPrivilegedApiAndOwners
TagsEntra, EntraOps, Graph, LongRunning, MT.1077, Privileged, XSPM

Source​

  • Pester test: tests/XSPM/Test-XspmPrivilegedIdentities.Tests.ps1
  • PowerShell source: powershell/public/xspm/Test-MtXspmAppRegWithPrivilegedApiAndOwners.ps1