External Microsoft Entra application owns an app registration whose service principal has administrator-equivalent RBAC rights

azure

Description

A tenant-local service principal for an application registered in another Microsoft Entra tenant owns an app registration in the local tenant whose associated service principal has administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. Compromise of the external application or its home tenant could allow an attacker to modify the owned app registration and use its service principal’s administrative permissions.

Remediation

  1. Verify that the external application is trusted and still requires ownership of the app registration, then remove unnecessary application ownership. See Remove an application owner.
  2. Remove administrator-equivalent role assignments from the owned app registration’s service principal and grant only the permissions required by the application. See Remove Azure role assignments.