Securing Microsoft Entra ID Applications: Addressing the Threat of Misconfigured Permissions

Webinar Details

Misconfigured app permissions in Microsoft Entra ID pose a significant security risk, enabling attackers to exploit applications with excessive or improperly assigned privileges. This session dives into the vulnerabilities associated with misconfigurations, such as assigning non-administrative accounts as application owners and granting unconstrained permissions like Mail.ReadWrite or Mail.Send.

Participants explore real-world examples, including the Midnight Blizzard attack, which exploited a compromised OAuth application to infiltrate Microsoft’s tenant.

Learn actionable strategies to mitigate these threats, including:

Implementing stringent access controls for app ownership.
Applying the principle of least privilege to app permissions.
Utilizing tools such as PowerShell cmdlets and security scanners to enforce application access policies and monitor elevated permissions.

Where can I learn more about Application Governance and Security in Entra ID?

The AppGov Community resources are put together by the team at ENow Software with Microsoft MVPs and subject-matter experts to ensure we can offer the most valuable information and updates to make your job easier. Application Governance is a newer challenge that many organizations are just now starting to uncover - our goal is to help you on that journey. Here are a few resources to check out:

Where can I learn more about ENow's AppGov solutions?

Requesting your free AppGov Score is a great place to get started. It will give you a risk score and outline the extent of your Application Governance and security risk. Get your AppGov Score.

If you're interested in drilling into the specific applications, permissions, and settings for quicker remediation and workflows, you can explore the paid App Governance Accelerator tool. We have three versions to help you achieve your application governance goals and secure your Entra Apps, Registrations, settings & Identities. Learn more about App Governance Accelerator.

Alistair Pugin

M365 + Security MVP | Blogger | Podcaster | Speaker | Founder, CEO - YModernize

Alistair has worked in various capacities in multiple verticals from retail-manufacturing to government, spanning 50 to 50000 users utilizing all aspects of pure Enterprise Information Management.

Specialties: 20+ years pure IT, 16 years ECM, Livelink, Zylab, SharePoint, FileNet, etc. IT Pro dabbling in Dev, ECM Consultant, Suffering from Technophilia. Technology Architect specializing in Business Productivity Enrichment.

Connect on LinkedIn

Nicolas Blank

Founder, Group CEO, Architect, Podcaster, Author, MVP Office Apps & Services, MVP Azure, MCM & MCSM Messaging at NBConsult

Nicolas is the founder, as well as an architect, author, and speaker focused on Office 365 and Azure at NBConsult Group in South Africa, England, and Hong Kong. Nicolas is a Microsoft Certified Master for Exchange and Office 365, Microsoft MVP for Microsoft Office Apps and Services since March 2007.

Nicolas has co-authored the Microsoft Zero Trust Adoption Framework, published by Microsoft; “Microsoft Exchange Server 2013: Design, Deploy and Deliver an Enterprise Messaging Solution”, published by Sybex and available on Amazon; as well as authoring “Azure Site Recovery: IaaS Migration and Disaster Recovery,” published by Pluralsight.

Connect On LinkedIn