Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'
Checks the Microsoft Entra ID authorization policy setting `allowed_to_create_apps`, which governs whether users can register applications. Application creation is expected to be limited to administrators or explicitly delegated roles.
What this control checks
The Users can register applications setting must be set to No
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.2 Information security roles and responsibilities
- A.5.15 Access control
- A.5.18 Access rights
- A.8.2 Privileged access rights
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 6.14 Ensure that 'Users can register applications' is set to 'No'
- 5.14 Ensure that 'Users can register applications' is set to 'No'
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- 1.14 Ensure That 'Users Can Register Applications' Is Set to 'No'
- 1.14 Ensure That 'Users Can Register Applications' Is Set to 'No'
- 1.13 Ensure That 'Users Can Register Applications' Is Set to 'No'
- 2.14 Ensure That 'Users Can Register Applications' Is Set to 'No'
- 164.308(a)(4)(ii)(C) Access establishment and modification
Related controls
- Azure subscriptions should limit owners to 3
- Microsoft Entra ID tenants should limit Global Administrators to fewer than 5
- Microsoft Admin Portals should require multifactor authentication
- Microsoft Entra ID policies should have 'Require Multifactor Authentication to register or join devices with Microsoft Entra' set to 'Yes'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_user_not_allowed_to_register_application - Powerpipe Control:
azure_compliance.control.iam_user_not_allowed_to_register_application - Prowler Check:
entra_policy_ensure_default_user_cannot_create_apps
Last reviewed: 2026-10-13