Enterprise applications with full control or write permissions
AI summary
Rencore Governance detects enterprise applications with FullControl or Write permissions, which create security risks because a compromised application would gain broad tenant access. Review each application and replace these broad permissions with narrower alternatives that still accomplish your business requirements.
What it detects
Shows Enterprise applicationsEnterprise applicationAn enterprise application is the local instance of an app in a Microsoft Entra tenant, its service principal, where admins control who can sign in and which permissions it holds.Read more with permissions that contain the words FullControl or Write.
Why it matters
Write and Full Control permissions let an app change or delete data, not just read it. If such an app is compromised or its secret leaks, the attacker gets the same rights, often across the whole tenant. Review each app with its owner and replace broad permissions with the narrowest ones that still work, for example Sites.Selected instead of Sites.FullControl.All.
The rule
Every Enterprise Application that has any App Role Assignment Service Principals where Display Name includes one of 'FullControl,ReadWrite,Write'
In Rencore Governance
Details
| Applies to | Enterprise application |
|---|---|
| Connector | Entra ID |
| Severity | Medium |
| Category | Security |
| Recommended | No |
| Recommended automation | None |
| License type | Standard |
Related policies
Other policies that check Enterprise application objects:
- Enterprise applications using Exchange Web Services (EWS) (High)
- Enterprise applications that use SharePoint Online permissions (Information)
- Enterprise applications without owners (Medium)
- Enterprise applications (SharePoint add-ins) with certificates or client secrets (Medium)
- Enterprise applications that use Microsoft Graph permissions (Information)
- Enterprise applications (SharePoint add-ins) with expired certificates or client secrets (Medium)
Frequently asked questions
What does the enterprise applications with full control or write permissions policy detect?
The Enterprise applications with full control or write permissions policy shows Enterprise applications with permissions that contain the words FullControl or Write.
Which objects does the enterprise applications with full control or write permissions policy check?
The Enterprise applications with full control or write permissions policy checks Enterprise application objects from the Entra ID inventory and reports each one that matches its rule as a violation.
How severe is a violation of the enterprise applications with full control or write permissions policy?
Violations of the Enterprise applications with full control or write permissions policy have Medium severity. The policy is in the Security category.
Which module includes the enterprise applications with full control or write permissions policy?
The Enterprise applications with full control or write permissions policy comes with the Entra ID connector in the Digital Workplace module of Rencore Governance, which every Plan includes.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?