User Owned Apps Restricted

<# .SYNOPSIS User-Owned Apps Restricted .DESCRIPTION Prevents users from creating/registering their own apps in Azure AD .NOTES NL Baseline v2.0 #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param([switch]$Monitoring, [switch]$Remediation, [switch]$Revert, [switch]$WhatIf) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "User-Owned Apps Restricted" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome $authPolicy = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" $usersCanCreateApps = $authPolicy.defaultUserRolePermissions.allowedToCreateApps $usersCanConsent = $authPolicy.defaultUserRolePermissions.permissionGrantPoliciesAssigned Write-Host " Users can create apps: $(if($usersCanCreateApps){'ALLOWED'}else{'BLOCKED'})" -ForegroundColor $( if (-not $usersCanCreateApps) { 'Green' }else { 'Red' } ) Write-Host " Permission grant policies: $($usersCanConsent -join ', ')" -ForegroundColor Gray Write-Host "`n Security Impact:" -ForegroundColor Cyan Write-Host " • Prevents shadow IT apps" -ForegroundColor Gray Write-Host " • Enforces IT oversight" -ForegroundColor Gray Write-Host " • Reduces data leakage risk" -ForegroundColor Gray if (-not $usersCanCreateApps) { Write-Host "`n[OK] COMPLIANT - App creation restricted to admins" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Users can create apps!" -ForegroundColor Red exit 1 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" -ErrorAction Stop -NoWelcome $body = @{ defaultUserRolePermissions = @{ allowedToCreateApps = $false } } | ConvertTo-Json Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy" -Body $body -ErrorAction Stop Write-Host "`n[OK] User app creation restricted" -ForegroundColor Green Write-Host "Only admins can create apps now" -ForegroundColor Cyan exit 0 } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { try { Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" -ErrorAction Stop -NoWelcome $body = @{ defaultUserRolePermissions = @{ allowedToCreateApps = $true } } | ConvertTo-Json Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy" -Body $body -ErrorAction Stop Write-Host " ⚠️ Users can now create apps" -ForegroundColor Yellow exit 0 } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Revert) { Invoke-Revert } elseif ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring | -Remediation | -Revert" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }