The settingWhat we hold this to
CreativeTechs minimum
defaultUserRolePermissions.allowedToCreateApps = false. User consent for applications = 'Do not allow user consent', OR 'Allow for verified publishers, selected permissions' limited to low-impact scopes. Admin consent request workflow = enabled with a named reviewer.
Benchmark position
EIDSCA.AP10 — recommended value 'false'. CISA SCuBA 2.6 — only administrators SHALL be allowed to register third-party applications. Our minimum matches.
Where we differ, and why
We permit the verified-publisher/low-impact variant where a client's workflow needs it; CISA reads stricter. Record it as an exception on the client when used.
Where the switch is
Entra admin centre → Identity → Users → User settings → App registrations. Then Identity → Applications → Enterprise applications → Consent and permissions → User consent settings, and → Admin consent settings.
How to verify
Graph: /policies/authorizationPolicy → defaultUserRolePermissions.allowedToCreateApps eq false
- Why it matters
- The default lets any user register an application and consent to third-party OAuth apps. That's the consent-phishing path — it never touches a password and MFA doesn't stop it.
- How we check
- Maester CISA.MS.AAD.5.1, EIDSCA.AP10. Secure Score IntegratedApps.
- Fix — M365
- Entra → User settings → Users can register applications = No. Enterprise apps → Consent and permissions → no user consent (or verified publishers, low-impact only). Turn on admin consent requests.
- Fix — Google
- Admin → Security → API controls → restrict third-party app access; unconfigured apps blocked.
- User notices
- Users hit “ask an admin” when connecting a new SaaS tool. Someone must watch the consent queue.
- Expected pushback
- Real at tool-happy creative teams. Middle ground: auto-allow verified-publisher low-impact scopes, review the rest.