Overview

The App Registrations tab shows every non-human identity in your client's Microsoft 365 tenant, including app registrations and enterprise applications. Use it to find shadow IT, credential risks, and over-permissioned applications.

How It Works

Health summary

The top of the tab shows key health metrics:

• Total App Registrations — total registered apps and enterprise applications
• QUICK WIN - Unused — applications that haven't been used recently and may be safe to remove
• Expired Credentials — apps whose credentials have already expired
• Expiring Soon — apps with credentials expiring within a configurable window (default: 365 days)
• High Risk (50+) — apps with a risk score of 50 or above
• Healthy — apps with no significant risk factors

App table

Each application is listed with:

• Name — application display name
• Source Type — App Registration or Enterprise Application
• Risk Score — numeric score based on combined risk factors
• App ID — the Microsoft application ID
• Owners — number of assigned owners (flagged if none)
• Assigned Users — number of users assigned to the app
• Credentials — credential status and count
• App Permissions — application-level (app-only) permissions granted
• Delegated Permissions — permissions granted on behalf of users
• Last Used — when the app was last accessed
• Expiration Date — when the app's credentials expire (highlighted in red if soon)
• Created Date — when the app was registered

You can search by name or app ID, filter results, export as CSV, and refresh the data on demand.

Remediation Guide: App Registrations

App registrations are custom applications registered in Microsoft Entra ID. They define the application and can hold credentials (secrets or certificates) and API permissions.

Expired or expiring credentials

1. Open the app in Microsoft Entra → App registrations.
2. Go to Certificates & secrets.
3. Remove expired credentials.
4. If the app is still in use, generate a new secret or upload a new certificate.
5. Update the consuming application with the new credential.

No owners assigned

1. Open the app in Entra → App registrations → Owners.
2. Add at least one owner, so someone is accountable for the app and receives expiry notifications.

Unused applications

1. Confirm the app is no longer in use by checking its Last Used date in Optimize365.
2. Check with the app owner or team before removing it.
3. As a safe first step, disable the app instead of deleting it.
4. Once confirmed unused, delete the app registration to reduce your attack surface.

Over-permissioned applications

1. Review the API permissions tab in Entra.
2. Identify permissions the app doesn't need for its function.
3. Remove unnecessary application and delegated permissions.
4. Pay special attention to high-privilege permissions such as Mail.ReadWrite, Directory.ReadWrite.All, and RoleManagement.ReadWrite.Directory.

Remediation Guide: Enterprise Applications

Enterprise applications (service principals) are instances of an application in your tenant. They include third-party SaaS apps, Microsoft first-party apps, and any app a user or admin has consented to.

Unknown or unreviewed third-party apps

1. Go to Entra → Enterprise applications.
2. Review apps with delegated permissions — a user or admin consented to these.
3. Verify each app is a legitimate business tool.
4. Remove apps that are no longer used or were never authorized.

Excessive delegated permissions

1. Check which permissions users consented to on behalf of the organization.
2. Revoke consent for apps whose permissions exceed their intended use.
3. Consider configuring user consent settings in Entra so future consent is limited to admin-approved apps.

Disabled but not removed

Disabled enterprise apps still keep their permissions and credentials. If an app is no longer needed, remove it fully instead of leaving it disabled. This prevents accidental reactivation and reduces clutter.

Remediation Guide: Managed Identities

Managed identities are managed automatically by Azure and used by Azure resources to authenticate to services. They have no traditional credentials but can still be over-permissioned.

Over-permissioned managed identities

1. Go to Entra → Enterprise applications and filter by Managed Identities.
2. Review the API permissions assigned.
3. Apply least privilege — grant only the permissions the resource actually needs.
4. Use Azure RBAC role assignments to scope access to specific resources instead of broad API permissions.

Orphaned managed identities

1. If the Azure resource that created a managed identity has been deleted, the identity may still exist.
2. Check whether the identity is still attached to an active resource.
3. Remove orphaned identities to reduce your attack surface.

User-assigned vs. system-assigned

• System-assigned identities are tied to one resource and are deleted with it.
• User-assigned identities can be shared across resources and must be managed independently.
• Review user-assigned identities regularly; they persist even after the resources using them are removed.

Related Articles

• Users Posture
• Conditional Access Policies
• Client Portal