EIDAPP-018: Change Tracking on App Registrations and Service Principals
- Platform
- Entra ID / M365
- Category
- Consent
- Severity
- Medium
- Zero Trust pillar
- Applications & Workloads (weight 1)
- Golden fixtures
- 1
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Changes to application registrations and service principals such as new credential additions, permission modifications, or configuration changes should be tracked and reviewed. Attackers frequently modify existing applications to add backdoor credentials, escalate permissions, or change redirect URIs as part of persistence and privilege escalation techniques. Without change tracking, these modifications can go undetected indefinitely.
Recommended value
All changes to application registrations and service principals logged, monitored, and reviewed with alerts for high-risk modifications
Remediation
Configure audit log monitoring to capture all changes to application registrations and service principals including credential additions, permission changes, and configuration modifications. Create alert rules in Microsoft Sentinel or Azure Monitor for high-risk changes such as new credentials added to existing applications, application permission grant changes, and reply URL modifications. Establish a review process for all application changes with designated security reviewers.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| not-implemented | Not Assessed |
Framework mappings
- NIST SP 800-53
- CM-3, SI-4
- MITRE ATT&CK
- T1098