In Microsoft Entra ID, enterprise applications without assigned owners, often referred to as "ownerless apps" pose significant risks to organizational security and governance. The absence of an owner means no individual is explicitly responsible for managing the application’s configuration, permissions, or access policies.
Think of an enterprise application like a company car. If no one is assigned as the ‘owner’ responsible for its maintenance, it might be left unlocked, untracked, or misused, creating risks for the organization. Similarly, ownerless apps in Entra ID can become security liabilities if no one is specifically responsible for regularly monitoring them. You can learn more about how application ownership is assigned in Entra ID depending on their administrator role, or lack thereof. It’s also important to make sure your organization understands Microsoft’s Shared Responsibility model in the cloud.
Let’s dig into some of the critical issues that can be associated with Ownerless Apps:
Risks of Ownerless Enterprise Apps in Entra ID
- Unmonitored Configuration Changes: Without an owner, there’s no designated person to oversee or approve changes to the application’s settings, such as delegated API permissions, secrets, or user assignments. Unauthorized or accidental modifications may go unnoticed, increasing the risk of misconfigurations that expose sensitive data or systems.
- Lack of Accountability: Ownerless apps lack accountability, making it difficult to trace who is responsible for the application’s purpose, usage, or security. This can complicate audits and incident response, especially in the event of a breach.
- Accumulation of Excessive Permissions: Without regular oversight, ownerless apps may retain outdated or overly permissive API permissions (e.g., Directory.ReadWrite.All). Attackers can exploit these permissions to escalate privileges or access sensitive resources.
- Consent Prompt Vulnerabilities: Ownerless apps may rely on user or admin consent for permissions, and without an owner to review these prompts, users may inadvertently grant broad access to malicious applications, amplifying risks like those seen in attack tactics used by threat actors such as Midnight Blizzard.
- Neglected Maintenance: Applications without owners are often neglected, leading to unpatched vulnerabilities, outdated integrations, or unused apps that serve as potential entry points for attackers.
- Compliance and Governance Gaps: Regulatory frameworks and internal policies often require clear ownership for applications handling sensitive data. Ownerless apps can lead to non-compliance, potentially resulting in fines or reputational damage.
How Do Ownerless Apps Happen?
Ownerless apps typically arise due to the default behavior of Entra ID during application creation. When an enterprise application is created in Microsoft Entra ID, ownership is not always automatically assigned. If the account creating the application lacks specific administrative permissions, specifically these roles: Application Administrator, Global Administrator, Privileged Role Administrator, and Cloud Application Administrator, Entra ID automatically assigns that account as the owner. However, if the account has these elevated permissions, no owner is assigned by default. This can result in “ownerless” applications, which lack a designated individual responsible for managing the app’s settings, permissions, or security. Identifying and addressing ownerless apps is critical to ensure proper governance, accountability, and security in your Entra ID environment. Common scenarios include:
- Administrative Oversight: IT admins with elevated privileges create applications but fail to assign owners, assuming ownership will be handled later.
- Decentralized App Creation: Non-IT users or developers register apps for testing or business purposes without understanding the need for ownership.
- Legacy or Abandoned Apps: Applications created by former employees or for short-term projects may become ‘orphaned’ when their owners' accounts are deactivated or the projects come to an end.
- Bulk App Registrations: Automated or bulk app creation processes may skip owner assignment, resulting in apps without an assigned owner.
How to Find Ownerless Enterprise Apps in Entra ID
As discussed in the previous blog post, Why Enterprise Application Owners Matter in Entra ID Governance, the role of application owners is critical to balancing usability and security. However, the risks associated with ownerless apps highlight an equally important aspect of governance: ensuring that every enterprise application has a designated owner. The ENow App Governance Accelerator’s Ownerless Apps report is a powerful tool for identifying these gaps, providing organizations with actionable insights to implement a robust application management delegation model.
Ownerless apps are not just a technical oversight; they can be a security and compliance liability. The absence of an owner exacerbates risks such as scope creep, popup fatigue, and vulnerabilities exploited in attacks like those attributed to the threat actor, Midnight Blizzard. By leveraging tools like the ENow App Governance Accelerator, organizations can proactively identify ownerless apps and assign appropriate owners, aligning with best practices for secure application governance.
Recommendations for Addressing Ownerless Apps in Entra ID
To safeguard your organization’s Entra ID environment, take the following steps:
1. Run the Ownerless Apps Report: If you’re an App Governance customer, use ENow App Governance Accelerator to generate a report on enterprise applications without owners. Review the list to identify critical or high-risk apps that require immediate attention.
2. Use the Microsoft Graph PowerShell SDK to identify ownerless applications: The following script retrieves all service principals (representing enterprise applications) and checks for those without owners:
Identifying Ownerless Applications with PowerShell
To find ownerless enterprise applications (excluding most first-party Microsoft Apps), you can use the Microsoft Graph PowerShell SDK.
# Install Microsoft Graph PowerShell SDK if not already installed (uncomment if needed)
# Install-Module Microsoft.Graph -Scope CurrentUser
try {
# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Application.Read.All" -ErrorAction Stop
Write-Host "Connected to Microsoft Graph successfully."
# Get all service principals
$servicePrincipals = Get-MgServicePrincipal -All -ErrorAction Stop
# Filter for service principals without owners and exclude Microsoft first-party apps
$ownerlessApps = $servicePrincipals | Where-Object { $_.Owners -eq $null -and
$_.appOwnerOrganizationId -ne "f8cdef31-a31e-4b4a-93e4-5f571e91255a" -and
$_.appOwnerOrganizationId -ne "6334514b-36e7-44c6-887a-5463e10562be" }
# Output the ownerless apps
if ($ownerlessApps) {
Write-Host "Found" $ownerlessApps.Count "ownerless enterprise applications (excluding Microsoft first-party apps):"
$ownerlessApps | Select-Object DisplayName, AppId, PublisherName, CreatedDateTime |
Format-Table -AutoSize
# Export to CSV
$ownerlessApps | Select-Object DisplayName, AppId, PublisherName, CreatedDateTime |
Export-Csv -Path "OwnerlessApps_$ (Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "Results exported to OwnerlessApps_$(Get-Date -Format 'yyyyMMdd').csv"
} else {
Write-Host "No ownerless enterprise applications found (excluding Microsoft first-party apps)."
}
}
catch {
Write-Host "An error occurred: $($_.Exception.Message)" -ForegroundColor Red
}
finally {
# Disconnect from Microsoft Graph
Disconnect-MgGraph -ErrorAction SilentlyContinue
Write-Host "Disconnected from Microsoft Graph."
}
3. Assign Owners Strategically: Based on the report, assign owners to every enterprise application. Consider a hybrid model where IT or security team members co-own critical apps, while business stakeholders manage day-to-day tasks for less sensitive applications.
4. Establish Governance Policies: Implement internal policies requiring owner assignment during app creation.
5. Educate and Train Owners: Provide training for all owners (IT and non-IT) on their responsibilities, including how to evaluate API permissions, recognize suspicious consent prompts, and avoid pop-up fatigue.
6. Monitor and Audit Regularly: Schedule recurring audits of application ownership using the ENow App Governance Accelerator, Microsoft Sentinel, PowerShell, or a third-party SIEM solution. Ensure no new ownerless apps are created and that existing owners remain active and appropriate.
7. Strengthen Security Controls: Enforce multi-factor authentication (MFA) and Conditional Access for all owners. Restrict user consent for ownerless apps to prevent unauthorized permissions.
Don’t Let Ownerless Apps Get the Better of You
By addressing ownerless apps, organizations can close a critical gap in their Entra ID governance strategy, reducing the risk of misconfigurations, breaches, and compliance violations. Don’t let ownerless apps become a weak link in your security posture; act now to ensure every enterprise application has a responsible and informed owner.
Get Started Today: Identify and manage ownerless apps in your Entra ID tenant. Learn how ENow’s Entra ID solutions, such as ENow AppGov Score and ENow App Governance Accelerator, enhance your application governance and security.
