MT.1078: App registrations with highly privileged directory roles should not have owners.

ID	MT.1078
Severity	Medium
Suite	Mito
Product	Defender
Related products	Entra ID
Feature	Exposure Management
Security area	Applications and workload identities
Resource type	Application
User impact of fixing	Low
Effort to fix	Medium
Framework controls	nist-800-53-r5:AC-6 Least Privilege
MITRE ATT&CK	T1098.001
Reads from	Microsoft Graph

What this checks and how to fix it

Owners with lower privilege than the application should be removed from ownership. Microsoft also mentions this risk of elevation of privilege over what the owner has access to as a user. Those delegations can be identified by the Tier breach flag in the test results.

But even owners with the same or higher privilege should not be delegated ownership because of missing support for just-in-time access (eligibility in PIM), enforced step-up authentication (authentication context by PIM in Entra ID roles), or assignment via group membership.

Side Note: Currently, due to limitations of XSPM data, only assignments on application objects are identified.

How to fix

Remove ownership and replace it (if necessary) by using object-level role assignments, and avoid any lateral movement paths by delegating to administrators with lower privilege classification (tier breach).

---

Mito check. Author: Cloud-Architekt. Open-source licences.