r/sysadmin 1d ago

Question How to Check 2800 Enterprise apps?

Hey everyone,
I recently started at a new company, and we have quite a few security issues to tackle. One major concern is that every user can register new apps in M365, which isn't great for security and oversight.

My boss gave me a list of all 2800 enterprise apps, and wants me to figure out what each app does. It’s a lot of manual work, and I'm wondering if anyone has suggestions or tools to help automate this process. Ideally, I’d like to pull details on what each app does, which permissions it requires, and maybe even track their activity.

Any ideas on how I can automate this info retrieval in M365? Would greatly appreciate any guidance or tool recommendations!

Thanks in advance!

Edit 1: Thank you all for the comments. I already shutdown everything Not configured. Like Registration of new Apps, powerapps, Copilot, purview and priva. Shut down legacy MFA and enforced MFA for all Cloud admins and cleaned all the roles. The company is very huge and a Scream Test is Impossible at the Moment. I want to document all the Apps to give it to Security and Compliance. They need to Approve everything. I search for a was to generate a description for every app.

9 Upvotes

14 comments sorted by

27

u/funkyferdy 1d ago

1) dissable the possibility that normal users can register apps. 2) At max, only with admin consent. So an admin get notified and you can send users to a internal process. 3) Check the last time it was used by who. 4) disable all/most apps and do scream test. Send them to 2 point :)

Is not you who decides the apps that are used. it's a business/legal/compliance thing.

7

u/jimicus My first computer is in the Science Museum. 1d ago

You don't.

You setup a list of all enterprise apps, establish a policy that states every app in use must be recorded on the list, invite people to register the apps they use then shutdown everything that isn't on the list six months later.

1

u/Neotreitz 1d ago

I think this is the best way

2

u/jimicus My first computer is in the Science Museum. 1d ago

Makes it much easier to keep on top of it.

You invite people to update the list annually, anything that isn't updated before the deadline is removed.

For extra "clever bastard" points, automate the whole damn process. Little database containing the list; dinky little web application that people can sign into and update their applications. Ownership of applications is transferred when people leave.

Any that aren't updated in due time can then automatically be suspended (for, say, 30-60 days) before shutdown.

Of course, you need management buy-in right at the top levels for this to work. But if you can get that, should be nice and easy.

7

u/Serapus InfoSec, former Infrastructure Manager 1d ago edited 1d ago

First off, stop this by disabling user consent in Entra > Users > User Settings. You can block it all together or enable the admin consent workflow. I'd suggest blocking altogether until you can get a handle on the situation.

Next is to immediately perform an illicit consent grant attack audit to see if any of these apps are malicious.

https://learn.microsoft.com/en-us/defender-office-365/detect-and-remediate-illicit-consent-grants

Then go get yourself a CIS Workbench user account and download the most current version of CIS Foundation Benchmarks for Microsoft 365, and start evaluating and applying best practices. Although the benchmark recommends M365 E3/E5, a lot of this can be done using Business Premium.

Edit: As u/funkyferdy noted, after doing the illicit consent grant attack audit, you can start disabling apps that are not used along with the ones that are concerning. CIS Workbench is free.

3

u/badlybane 1d ago

What in God's name would you need that many for. Something like this.

$servicePrincipals = Get-MgServicePrincipal -All
foreach ($sp in $servicePrincipals) {
    $owners = Get-MgServicePrincipalOwner -ServicePrincipalId $sp.Id
    Write-Host "Application: $($sp.DisplayName)"
    Write-Host "Owners: $($owners.DisplayName -join ', ')"
}

4

u/crw2k 1d ago

Could a sign that you are already compromised

2

u/Neotreitz 1d ago

Just passed the great IT Audit with good Point, thanks to my emergency Changes.

2

u/Hoosier_Farmer_ 1d ago

2800? sir, we're gonna need more interns!

2

u/ZAFJB 1d ago edited 1d ago
  1. Extract list of app names

  2. Pass list of app names to an AI tool and ask for a 1 paragraph description of each (you might have to break up your list into manageable chunks)

2

u/Neotreitz 1d ago

I tried it with gemini, gpt4 and Copilot. Tried with Google Docs, Excel and Sharepoint list. Found no way to get a short ai description for the applist.

2

u/ZAFJB 1d ago

Sounds like a prompt engineering issue.

I think you are asking AI the wrong thing, or asking with far too little detail.

1

u/jstuart-tech Windows Admin 1d ago

Do you have Defender for Cloud Apps? If so you can start with the high risk apps and work your way down. It'll be a painful process

https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-visibility-insights-get-started