APP — Application Security

Application and OAuth security controls. 15 controls in total — 14 automatic, 1 attested.

How to read

Result: ✅ Pass · ⚠️ Warning · ❌ Fail · N/A Not evaluated. Status: Auto = Controlio measures it app-only · Attested = the customer marks it. Lv: L1 basic, L2 advanced.

Control	What it checks	Result criteria	Status
APP-01 Long-unused application registrations L1	Checks application registrations unused for more than a year. Abandoned registrations become an entry point for attackers.	✅ None · ⚠️ 1–3 · ❌ More than 3	Auto
APP-02 Expired application credentials L1	Checks for expired application passwords or certificates. Expired credentials signal a security gap.	✅ None · ❌ One or more	Auto
APP-03 High-privilege application permissions (OAuth) L2	Checks the high-privilege access permissions granted to applications. Excessive permissions raise the risk of data leakage.	✅ None · ⚠️ 1–2 · ❌ More than 2	Auto
APP-04 Admin-consented application permissions (OAuth) L1	Checks how many application permissions an admin has consented to. Too many make permission management harder.	✅ 5 or fewer · ⚠️ 6–15 · ❌ More than 15	Auto
APP-05 Application registration count L1	Tracks the number of registered applications. Uncontrolled growth makes management and security harder.	✅ 30 or fewer · ⚠️ 31–80 · ❌ More than 80	Auto
APP-06 Service principal count L1	Tracks the number of registered service principals. Unknown service principals carry hidden risk.	✅ 50 or fewer · ⚠️ More than 50	Auto
APP-07 Application credentials expiring soon L1	Checks application passwords or certificates expiring within 180 days. If they are not renewed in time, service is interrupted.	✅ None · ⚠️ 1–3 · ❌ More than 3	Auto
APP-08 Multi-tenant application count L2	Checks the number of multi-tenant applications open to outside organizations. Too many widen external access.	✅ 2 or fewer · ⚠️ 3–5 · ❌ More than 5	Auto
APP-09 Old service principal credentials L1	Checks service principal credentials that have not been renewed for a long time. Old credentials are exposed to leakage.	✅ None · ⚠️ 1–5 · ❌ More than 5	Auto
APP-10 Admin consent workflow L1	Checks whether user requests for application permissions go to admin approval. When it is off, users can grant permission to risky apps directly.	✅ Active · ❌ Off	Auto
APP-11 Unverified publisher applications L2	Checks the number of applications whose publisher is unverified. Unverified publishers carry a trust risk.	✅ None · ⚠️ 1–3 · ❌ More than 3	Auto
APP-12 Unused (credential-less) application registrations L2	Checks stale application registrations with no credentials at all. Unused registrations increase the attack surface.	✅ 5 or fewer · ⚠️ 6–15 · ❌ More than 15	Auto
APP-13 Identity federation instead of passwords L2	Checks whether applications use the more secure identity federation instead of a client secret. Secrets are exposed to leakage.	✅ In use · ⚠️ Not in use	Auto
APP-14 Owner and response time for admin consent requests L1	Checks whether an owner and a response time are set for application consent requests. Without them, requests go unanswered or are approved unchecked.	✅ Workflow on and owner assigned · ⚠️ Workflow on but no owner · ❌ Workflow off	Auto
APP-15 SSO and access policy for external SaaS apps L2	Checks whether external cloud apps are tied to central control through single sign-on. Without SSO, separate passwords are used, and central control and fast access revocation are not possible.		Attested Customer attestation (not measured automatically)