CISA.MS.AAD.5.1: Only administrators SHALL be allowed to register applications.

ID	CISA.MS.AAD.5.1
Severity	Medium
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	User and directory settings
Security area	Applications and workload identities
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.5.1 (SHALL)
Framework controls	cisa-scuba:MS.AAD.5.1 nist-800-53-r5:AC-6(10) Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions nist-800-53-r5:CM-5 Access Restrictions for Change
MITRE ATT&CK	T1098.001, T1098.003, T1528
Reads from	Microsoft Graph

What this checks and how to fix it

Only administrators SHALL be allowed to register applications.

Rationale: Application access for the tenant presents a heightened security risk compared to interactive user access because applications are typically not subject to critical security protections, such as MFA policies. Reduce risk of unauthorized users installing malicious applications into the tenant by ensuring that only specific privileged users can register applications.

Remediation action:

1. In Entra, under Identity and Users, select User settings.
2. For Users can register applications, select No.
3. Click Save.

Related links

• Entra admin center - User settings
• CISA Application Registration & Consent - MS.AAD.5.1v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: merill. Open-source licences.