EIDAPP-009: Stale Application Registrations
- Plataforma
- Entra ID / M365
- Categoría
- Consent
- Severidad
- Medium
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Application registrations with no recent sign-in activity may be abandoned, orphaned, or no longer needed, yet they retain all granted permissions and credentials. Stale applications expand the attack surface because they are unlikely to be monitored or maintained by their original owners, making them attractive targets for attackers seeking to leverage forgotten credentials or permissions. Regular cleanup of unused applications reduces the tenant's overall risk exposure.
Valor recomendado
No application registrations without sign-in activity in the last 90 days unless documented with a valid exception
Remediación
Review application sign-in logs in Entra ID to identify applications with no authentication activity in the past 90 days. Contact the listed application owners to confirm whether the application is still required. Disable or delete stale application registrations after confirming they are no longer needed, and remove any associated credentials and permissions.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-2(3)