Reading Time: 5 minutes
At NT Conference in Slovenia last week, I presented my five do’s and don’ts for managing Microsoft Entra ID applications. In just 45 minutes, I saw lightbulb moments across the audience as we explored how every Entra ID integration will eventually become an application. What surprised me most was how strongly the audience reacted to this reality, showing just how urgent this topic has become for IT and identity admins worldwide.
A Primer on Entra ID Applications
When Azure Active Directory first stepped into the light, it was focused on adoption and integration. From the start, it came with a model that solved the age-old problem around service accounts that we inherited from NT4 and Windows Server Active Directory: how not to abuse user accounts as service accounts.
Enterprise applications and application registrations were Microsoft’s magical mystical answer to this problem. However, without Azure AD – now Entra ID – being a part of any official Microsoft course or exam, the model never really took off.
How Exchange made applications take off
That changed when Microsoft Exchange Online dropped support for the legacy POP and IMAP protocols. Independent software vendors (ISVs) flocked to Entra ID applications to be able to read and write mailbox contents in a modern fashion. Overnight, a lot of legacy communications suddenly stopped and were converted to OAuth2 machine-to-machine authentication based on Entra ID applications.
Fast forward to 2025, and we’re seeing even more ISVs adopt the application framework, which offers granular API permissions, if you configure it right, extensive logging, and multi-tenancy features. Entra ID applications provide the perfect authentication for non-human identities (NHIs).
Some organizations have adapted the application model in Entra ID. Others have not. It appears that knowledge has been seeded in the industry, and it is coming to fruition.
Entra ID Applications Are Everywhere
Latest to Entra ID applications for their integrations, however, is Microsoft itself with application-based authentication in Entra Connect Sync. That’s right: even the On-premises Directory Synchronization accounts – the prime example of user accounts in Entra ID that are abused as service accounts – are going away. They are being replaced with an Enterprise Application in Entra ID. This is big news, as an expected 97% of organizations that use Active Directory have a hybrid setup with Entra ID.
Microsoft released app-based authentication as generally available in Entra Connect v2.5.76.0 on July 31st, 2025. New installations of Entra Connect of that version and future versions even default to app-based authentication.
The Challenge: Why Identity Admins Struggle With Entra ID Applications
Identity admins, however, struggle with their backup, monitoring, and communications solutions. They suddenly require these application registrations. I was surprised to see how many people in the audience – largely consisting of Entra admins from the region – took out their camera to take a photo of the slide that provides an overview:
It was a little surprising to me that the attendees at my session were largely unaware of the movement in the industry to application-based authentication for cloud services.
As previously mentioned, Entra ID application integration isn’t part of the official Microsoft curriculum. But that’s not all. Over the past decade, several significant trends have emerged, casting clouds over a largely clear sky for identity administrators. In addition to Entra ID application adoption, identity admins must keep up with several other critical trends affecting Active Directory security and Microsoft Entra ID management:
- Plan Domain Controllers upgrades more meticulously as Microsoft more strongly enforces the Windows Server support lifecycles. Windows Server 2003-based Domain Controllers no longer cut it, although many Active Directory admins still manage Active Directory like it’s 2003…
- Perform Domain Controller updates more frequently, as Active Directory is a prime target for adversaries. Not a monthly update has gone by these past 3 years, where there wasn’t a vulnerability addressed in Active Directory Domain Services, Active Directory Certificate Services, Kerberos, Netlogon, DNS, SMB, TCP/IP, Windows Hello for Business or http.sys (used by Active Directory Federation Services). All of these represent opportunities for adversaries to gain control of the entire environment… and when Active Directory gets pwned, it’s game over for most.
- Install and maintain all sorts of cloud-oriented software packages on and towards Domain Controllers to monitor (like the Entra Connect Health agent), report suspicious activity (like the Defender for Identity sensor), and enforce stronger password security (like the Entra Connect Password Protection agent). This software typically auto-updates, but when it doesn’t, it creates other challenges. To keep these automatic updates available, .NET Frameworks, etc., need to be kept up to date.
- Maintain Entra from a role-based access control (RBAC) perspective, so people within the organization (as well as guests and non-human identities) can safely use Microsoft 365 services, .
It’s no wonder there is little time for admins to focus on Entra ID applications. When putting out fires consumes 70% of your time, there are only so many hours in a month to keep your knowledge and certifications up to date, which don’t even include Entra ID applications…
Industry Feedback: Why Entra ID Applications Are Still a Blind Spot
The common feedback I received from the audience is that it’s an apparent niche. Other words that I’ve previously come across include ‘Pandora’s Box’ and ‘Blind Spot’. John O’Neill refers to it as a ‘hot potato'.
The Risks of Ignoring Entra ID Application Security – Your money or your career!
It’s dangerous to ignore Entra ID applications as an Identity admin, though.
Security incidents we’ve seen over the past few years, including the successful breach of Microsoft by Midnight Blizzard, the vulnerability that was abused in Metallic and a red teamer gaining access to Microsoft’s internal troubleshooting tools all show that one tiny suboptimal setting in Entra ID applications might cost your organization a lot of money, and potentially your job.
How to Get Started With Entra ID Application Governance
On October 19, 2023, ENow Software launched the AppGov Score solution and community. As I mentioned, there was a massive training and resources gap from Microsoft regarding this topic. To help close that gap, we began a knowledge-sharing effort through the AppGov Score community. Sean Hurley, along with myself and other Microsoft MVPs, contributed resources to help identity admins (or anyone ‘voluntold’ to manage Entra Apps) strengthen their skills, identify risks, and implement best practices for Microsoft Entra ID application security.
The ENow AppGov Score community features MVP-authored blogs, webinars, and a forum site for Identity admins to get their questions answered, whether they’re at the start of their journey or in the trenches. There’s always something new to learn with Entra ID applications, and for many, this journey is just beginning.
ENow has continued to evolve its free AppGov Score tool to provide a helpful starting point, along with its App Governance Accelerator solution, which provides detailed visibility, guidance, and automated remediation to strengthen the security of your organization’s application landscape, while lightening the load for identity admins.
It's time for Identity admins to embark on this journey to ensure their organization(s) remain in business and that their careers don’t get sidelined by Entra ID application misconfigurations.
Jokingly, at the end of my presentation, I asked if the attendees looked sad because I just gave them extra work for Monday. I couldn’t be more right.
There is a Chinese proverb:
"The best time to plant a tree was 20 years ago. The second-best time is now."
Please start now.
Login