EIDAPP-010: Multi-Tenant Application Analysis
- Platform
- Entra ID / M365
- Category
- Consent
- Severity
- Medium
- Zero Trust pillar
- Applications & Workloads (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Multi-tenant application registrations are configured to accept sign-ins from any Entra ID tenant, allowing users from external organizations to authenticate. While necessary for SaaS and partner scenarios, multi-tenant configuration on internal applications creates an unnecessary risk by allowing external identities to obtain tokens. Each multi-tenant application should be validated to confirm the configuration is intentional and that appropriate authorization controls are in place.
Recommended value
No multi-tenant application registrations unless required by business need with documented justification and appropriate authorization controls
Remediation
Review all application registrations and identify those with signInAudience set to AzureADMultipleOrgs or AzureADandPersonalMicrosoftAccount. For each multi-tenant application, validate that multi-tenant access is required and document the business justification. Convert applications that do not require multi-tenant access to single-tenant configuration and implement token validation to restrict which external tenants can access multi-tenant applications.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-20
- CIS M365 Benchmark
- 5.3.2