DPDP.2.4 - Third-party applications SHALL be disallowed from accessing personal data without valid DPA (Rule 5(4)).
Overview
5.1.2.2 (L2) Ensure third party integrated applications are not allowed
App registration allows users to register custom-developed applications for use within the directory.
Rationale
Third-party integrated applications connection to services should be disabled unless there is a very clear value and robust security controls are in place. While there are legitimate uses, attackers can grant access from breached accounts to third party applications to exfiltrate data from your tenancy without having to maintain the breached account.
Impact
The implementation of this change will impact both end users and administrators. End users will not be able to integrate third-party applications that they may wish to use. Administrators are likely to receive requests from end users to grant them permission to the necessary third-party applications.
Remediation action:
- Navigate to Microsoft 365 Entra admin center.
- Click to expand Entra ID > Users select Users settings.
- Set Users can register applications to No.
- Click Save.
PowerShell
- Connect to Microsoft Graph using
Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" - Run the following commands:
$param = @{ AllowedToCreateApps = "$false" }
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $param
Related links
- Microsoft 365 Entra admin center
- How and why applications are added to Microsoft Entra ID
- CIS Microsoft 365 Foundations Benchmark v6.0.1 - Page 173
Test Metadata
| Field | Value |
|---|---|
| Test ID | DPDP.2.4 |
| Severity | Unknown |
| Suite | DPDP Act 2023 |
| Category | IndiaDPDP |
| PowerShell test | Test-MtCisThirdPartyApplicationsDisallowed |
| Tags | DPDP, DPDP.2.4, DPDP2023, IndiaDPDP |
Source
- Pester test:
tests/dpdp/Test-MtDpdpBaselines.Tests.ps1 - PowerShell source:
powershell/public/cis/Test-MtCisThirdPartyApplicationsDisallowed.ps1