---
title: >-
  External Microsoft Entra application owns an app registration whose service
  principal has administrator-equivalent RBAC rights
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > External Microsoft Entra application
  owns an app registration whose service principal has administrator-equivalent
  RBAC rights
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# External Microsoft Entra application owns an app registration whose service principal has administrator-equivalent RBAC rights

## Description{% #description %}

A tenant-local service principal for an application registered in another Microsoft Entra tenant owns an app registration in the local tenant whose associated service principal has administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. Compromise of the external application or its home tenant could allow an attacker to modify the owned app registration and use its service principal's administrative permissions.

## Remediation{% #remediation %}

1. Verify that the external application is trusted and still requires ownership of the app registration, then remove unnecessary application ownership. See [Remove an application owner](https://learn.microsoft.com/en-us/graph/api/application-delete-owners?view=graph-rest-1.0).
1. Remove administrator-equivalent role assignments from the owned app registration's service principal and grant only the permissions required by the application. See [Remove Azure role assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-remove).