Rules/APP-003.ownerless-apps.psd1
|
@{ Id = 'APP-003' Title = 'Every app registration has at least one owner' Area = 'Applications' Severity = 'Low' References = @( 'https://learn.microsoft.com/entra/identity/enterprise-apps/overview-assign-app-owners' ) Rationale = 'Ownerless apps have nobody to answer "is this still needed?" - they accumulate stale credentials and permissions nobody reviews.' Remediation = 'Assign an accountable owner to each app registration or decommission apps nobody claims.' Test = { param($Snapshot) $applications = @($Snapshot.Applications.applications) $ownerless = @($applications | Where-Object { (-not $_.PSObject.Properties['owners']) -or @($_.owners).Count -eq 0 }) if ($ownerless.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence @($ownerless | ForEach-Object { $_.displayName }) } else { New-TLRuleResult -Status Pass -Evidence ("All {0} app registrations have owners." -f $applications.Count) } } } |