MT.1075: Require explicit assignment of Third Party Entra Apps.
| ID | MT.1075 |
| Severity | Medium |
| Suite | Mito |
| Product | Entra ID |
| Feature | Applications |
| Security area | Applications and workload identities |
| Resource type | ServicePrincipal |
| User impact of fixing | Medium |
| Effort to fix | High |
| Framework controls | nist-800-53-r5:AC-3 Access Enforcementnist-800-53-r5:AC-6 Least Privilege |
| MITRE ATT&CK | T1078.004 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”This test checks if you have any third party service principals that are open to all users. It is recommended to set ‘Assignment required?’ to Yes for all Third Party apps.
Remediation action
Section titled “Remediation action”Open all app service principals below and set ‘Assignment required?’ to Yes. Assign users under ‘Users and groups’ to provide them with explicit access. If desired, use the audit logs per SPN to determine who was using the application before locking them down.
Mito check. Author: jflieben. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.