The Microsoft Playbook for Cleaning Up Risky Apps in Entra ID

Summary

Jeff Sakowicz, a Microsoft Entra product leader, outlines a practical approach to reducing risk across app registrations, service principals, and other non-human identities. His central advice is to stop risky configurations from accumulating, then address existing exposure according to risk and likely disruption.

Main recommendations

• Balance security with usability. Overly restrictive controls can push developers and users toward less secure shadow IT. When blocking self-service, make sure people know how to request an approved alternative or exception.
• Treat important apps as production assets. Tenant separation can help protect production and multi-tenant applications, but it brings operational overhead. Where full separation is impractical, strengthen ownership and sponsorship controls for valuable apps and identities. Separating test, demo, and staging environments is often more achievable.
• Inventory and assess the estate. Use an existing asset or inventory process where possible. Assess risk across three dimensions:
  1. Active threats — handle these first.
  2. Security posture — for example, weak credentials, insecure redirect URIs, or legacy protocols.
  3. Blast radius — the permissions and privileges an identity has.

Stop new risk, then reduce existing exposure

• Review app management policies to prevent new weak password credentials from being added. These policies can use an enforcement date, allowing organizations to plan for disruption, prepare exception processes, and phase in restrictions.
• For existing issues, start with apps that combine weak credentials and high-impact access. Determine whether their permissions are still needed and reduce them where possible.
• Prefer system-managed credentials, such as managed identities or workload identity federation, where appropriate. This reduces the burden of creating, storing, and rotating secrets.
• Prioritize unused identities and credentials as well as highly privileged ones. Removing a genuinely unused identity can address several issues at once, such as weak credentials, excessive permissions, insecure redirect URIs, or legacy protocol use. Verify that it is not used only periodically, such as for seasonal work, before deleting it.
• Give mailbox access particular scrutiny. Attackers may target mail and other content directly or use mailbox access to steal information and conduct further social engineering.

Consent and app-permission safeguards

• Revisit consent policies, particularly in older tenants where consent may have been disabled years ago under a simpler policy model. The newer framework offers more ways to tune security and self-service to an organization’s needs.
• Understand protections that may already be active:
  • Verified Publisher status is used in consent decisions and other protections. For certain apps, lack of verification limits which tenant-level user permissions they can obtain.
  • Risk-based step-up consent can require admin review when a request appears risky, even if users would otherwise be allowed to consent. Jeff says it is enabled by default.
• Before approving consent, admins should:
  1. Ask what the app does and why it needs the requested access.
  2. Check whether the request makes sense for the business use.
  3. Identify whether the app is external or internal. For an internal app, establish who owns or created it.
  4. Check publisher verification and understand the permissions requested.
  5. Compare access with the app’s actual function and business value, and remove unnecessary permissions.

A long permission list is not automatically more dangerous than a short one: a broad permission may be represented by multiple narrower permissions. The important question is what access is being granted and whether it is justified.

Suggested admin workflow and tools

1. Understand the inventory, available Entra capabilities, and main risk categories.
2. Put policies in place to slow or stop the creation of risky configurations, with a plan for exceptions and user impact.
3. Use available tools—including Entra Recommendations and, where available, Defender, Identity Protection, and Identity Governance—to find and address existing issues.
4. Prioritize active threats, high-impact permissions, and unused or underutilized identities that can be removed with minimal disruption.
5. Apply the same principles—especially least privilege and early governance—to agent identities. Protections built into the Agent ID model do not remove the need to manage the full identity portfolio.

Guides or tutorials mentioned

This is an interview and security-administration discussion, not a step-by-step product tutorial. The speakers refer to recommended-practice guidance and links they intend to include in the show notes, and specifically recommend learning about consent policies and app management policies. No specific links or detailed walkthroughs are provided in the subtitles.

Main speakers and sources

• Merill Fernando — interviewer and host.
• Jeff Sakowicz — Microsoft Entra product leader and guest, discussing app and service-principal security, consent, and non-human identity management.