In Microsoft Entra ID, enterprise applications without assigned owners, often referred to as "ownerless apps" pose significant risks to organizational security and governance. The absence of an owner means no individual is explicitly responsible for managing the application’s configuration, permissions, or access policies.
Think of an enterprise application like a company car. If no one is assigned as the ‘owner’ responsible for its maintenance, it might be left unlocked, untracked, or misused, creating risks for the organization. Similarly, ownerless apps in Entra ID can become security liabilities if no one is specifically responsible for regularly monitoring them. You can learn more about how application ownership is assigned in Entra ID depending on their administrator role, or lack thereof. It’s also important to make sure your organization understands Microsoft’s Shared Responsibility model in the cloud.
Let’s dig into some of the critical issues that can be associated with Ownerless Apps:
Ownerless apps typically arise due to the default behavior of Entra ID during application creation. When an enterprise application is created in Microsoft Entra ID, ownership is not always automatically assigned. If the account creating the application lacks specific administrative permissions, specifically these roles: Application Administrator, Global Administrator, Privileged Role Administrator, and Cloud Application Administrator, Entra ID automatically assigns that account as the owner. However, if the account has these elevated permissions, no owner is assigned by default. This can result in “ownerless” applications, which lack a designated individual responsible for managing the app’s settings, permissions, or security. Identifying and addressing ownerless apps is critical to ensure proper governance, accountability, and security in your Entra ID environment. Common scenarios include:
As discussed in the previous blog post, Why Enterprise Application Owners Matter in Entra ID Governance, the role of application owners is critical to balancing usability and security. However, the risks associated with ownerless apps highlight an equally important aspect of governance: ensuring that every enterprise application has a designated owner. The ENow App Governance Accelerator’s Ownerless Apps report is a powerful tool for identifying these gaps, providing organizations with actionable insights to implement a robust application management delegation model.
Ownerless apps are not just a technical oversight; they can be a security and compliance liability. The absence of an owner exacerbates risks such as scope creep, popup fatigue, and vulnerabilities exploited in attacks like those attributed to the threat actor, Midnight Blizzard. By leveraging tools like the ENow App Governance Accelerator, organizations can proactively identify ownerless apps and assign appropriate owners, aligning with best practices for secure application governance.
To safeguard your organization’s Entra ID environment, take the following steps:
1. Run the Ownerless Apps Report: If you’re an App Governance customer, use ENow App Governance Accelerator to generate a report on enterprise applications without owners. Review the list to identify critical or high-risk apps that require immediate attention.
2. Use the Microsoft Graph PowerShell SDK to identify ownerless applications: The following script retrieves all service principals (representing enterprise applications) and checks for those without owners:
To find ownerless enterprise applications (excluding most first-party Microsoft Apps), you can use the Microsoft Graph PowerShell SDK.
# Install Microsoft Graph PowerShell SDK if not already installed (uncomment if needed)
# Install-Module Microsoft.Graph -Scope CurrentUser
try {
# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Application.Read.All" -ErrorAction Stop
Write-Host "Connected to Microsoft Graph successfully."
# Get all service principals
$servicePrincipals = Get-MgServicePrincipal -All -ErrorAction Stop
# Filter for service principals without owners and exclude Microsoft first-party apps
$ownerlessApps = $servicePrincipals | Where-Object { $_.Owners -eq $null -and
$_.appOwnerOrganizationId -ne "f8cdef31-a31e-4b4a-93e4-5f571e91255a" -and
$_.appOwnerOrganizationId -ne "6334514b-36e7-44c6-887a-5463e10562be" }
# Output the ownerless apps
if ($ownerlessApps) {
Write-Host "Found" $ownerlessApps.Count "ownerless enterprise applications (excluding Microsoft first-party apps):"
$ownerlessApps | Select-Object DisplayName, AppId, PublisherName, CreatedDateTime |
Format-Table -AutoSize
# Export to CSV
$ownerlessApps | Select-Object DisplayName, AppId, PublisherName, CreatedDateTime |
Export-Csv -Path "OwnerlessApps_$ (Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "Results exported to OwnerlessApps_$(Get-Date -Format 'yyyyMMdd').csv"
} else {
Write-Host "No ownerless enterprise applications found (excluding Microsoft first-party apps)."
}
}
catch {
Write-Host "An error occurred: $($_.Exception.Message)" -ForegroundColor Red
}
finally {
# Disconnect from Microsoft Graph
Disconnect-MgGraph -ErrorAction SilentlyContinue
Write-Host "Disconnected from Microsoft Graph."
}
3. Assign Owners Strategically: Based on the report, assign owners to every enterprise application. Consider a hybrid model where IT or security team members co-own critical apps, while business stakeholders manage day-to-day tasks for less sensitive applications.
4. Establish Governance Policies: Implement internal policies requiring owner assignment during app creation.
5. Educate and Train Owners: Provide training for all owners (IT and non-IT) on their responsibilities, including how to evaluate API permissions, recognize suspicious consent prompts, and avoid pop-up fatigue.
6. Monitor and Audit Regularly: Schedule recurring audits of application ownership using the ENow App Governance Accelerator, Microsoft Sentinel, PowerShell, or a third-party SIEM solution. Ensure no new ownerless apps are created and that existing owners remain active and appropriate.
7. Strengthen Security Controls: Enforce multi-factor authentication (MFA) and Conditional Access for all owners. Restrict user consent for ownerless apps to prevent unauthorized permissions.
By addressing ownerless apps, organizations can close a critical gap in their Entra ID governance strategy, reducing the risk of misconfigurations, breaches, and compliance violations. Don’t let ownerless apps become a weak link in your security posture; act now to ensure every enterprise application has a responsible and informed owner.
Get Started Today: Identify and manage ownerless apps in your Entra ID tenant. Learn how ENow’s Entra ID solutions, such as ENow AppGov Score and ENow App Governance Accelerator, enhance your application governance and security.