EIDAPP-018: Change Tracking on App Registrations and Service Principals
- Plataforma
- Entra ID / M365
- Categoría
- Consent
- Severidad
- Medium
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 1
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Changes to application registrations and service principals such as new credential additions, permission modifications, or configuration changes should be tracked and reviewed. Attackers frequently modify existing applications to add backdoor credentials, escalate permissions, or change redirect URIs as part of persistence and privilege escalation techniques. Without change tracking, these modifications can go undetected indefinitely.
Valor recomendado
All changes to application registrations and service principals logged, monitored, and reviewed with alerts for high-risk modifications
Remediación
Configure audit log monitoring to capture all changes to application registrations and service principals including credential additions, permission changes, and configuration modifications. Create alert rules in Microsoft Sentinel or Azure Monitor for high-risk changes such as new credentials added to existing applications, application permission grant changes, and reply URL modifications. Establish a review process for all application changes with designated security reviewers.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| not-implemented | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-3, SI-4
- MITRE ATT&CK
- T1098