Enterprise applications: why you should turn on "Assignment required"
Hiding an application in the My Apps portal protects nothing. As long as "Assignment required" is off, any member of the tenant can sign in to it. It is one of the most common gaps we find, and one of the easiest to fix.
The default behaviour
Every enterprise application, in other words every service principal, has an "Assignment required" property (appRoleAssignmentRequired). When it is off, which is the default for many applications, Entra ID issues a token to any user in the tenant who asks for one. The application may then apply its own checks, but not always.
For a SAML application giving access to an HR tool, a finance portal or an admin console, this means the only barrier is often the role defined inside the application itself. If the application creates accounts automatically on first sign-in, any employee, or even a guest, can walk in.
Visibility and assignment: two separate settings
| Property | Effect | Security |
|---|---|---|
| Visible to users | Shows or hides the tile in My Apps and the Microsoft 365 app launcher. | None: the application is still reachable through its URL. |
| Assignment required | Only assigned users and groups get a token; everyone else gets an error. | Real: the control is enforced by Entra ID. |
When assignment is required, users also cannot consent to the application themselves: only an administrator can grant its permissions.
Admin tools. Client applications such as Microsoft Graph PowerShell or Graph Explorer let any user query the directory. Turning on assignment required for their service principals keeps these tools for the people who need them. Test first: some scripts or automations may rely on them.
Setting up assignments
- Inventory enterprise applications where assignment is not required, starting with SAML and OIDC applications integrated by the organisation.
- Identify legitimate user populations with the business owner, using the application's sign-in logs.
- Assign groups rather than individual users, so access follows the group lifecycle. Group assignment requires Entra ID P1 or higher; check the current terms.
- Turn the option on, then watch for sign-in failures caused by missing assignments over the following days.
Assignment required applies to user sign-ins. It does not limit an application authenticating as itself with application permissions; those belong to a permissions audit.
Adding Conditional Access
Assignment answers "who can get in". Conditional Access answers "under what conditions". The two work together:
- require a phishing-resistant method or a compliant device for sensitive applications;
- block guest access to applications not meant for them;
- enforce a shorter sign-in frequency for admin consoles.
A policy targeting "All resources" remains the best foundation, with per-application policies strengthening the sensitive cases.
What an audit checks
- Enterprise applications without assignment required, and how sensitive they are.
- The nature of assignments: groups or individual users, guests included.
- Restriction of client tools that give access to the directory.
- Conditional Access coverage of sensitive applications.
- An identified owner for every application.