TenantLens

1.3.2

Rules/APP-003.ownerless-apps.psd1

@{
    Id          = 'APP-003'
    Title       = 'Every app registration has at least one owner'
    Area        = 'Applications'
    Severity    = 'Low'
    References  = @(
        'https://learn.microsoft.com/entra/identity/enterprise-apps/overview-assign-app-owners'
    )
    Rationale   = 'Ownerless apps have nobody to answer "is this still needed?" - they accumulate stale credentials and permissions nobody reviews.'
    Remediation = 'Assign an accountable owner to each app registration or decommission apps nobody claims.'
    Test        = {
        param($Snapshot)
        $applications = @($Snapshot.Applications.applications)
        $ownerless = @($applications | Where-Object {
                (-not $_.PSObject.Properties['owners']) -or @($_.owners).Count -eq 0
            })
        if ($ownerless.Count -gt 0) {
            New-TLRuleResult -Status Fail -Evidence @($ownerless | ForEach-Object { $_.displayName })
        }
        else {
            New-TLRuleResult -Status Pass -Evidence ("All {0} app registrations have owners." -f $applications.Count)
        }
    }
}