Restrict access by assigning the app only to the users or groups that should be able to sign in, then require assignment for the application. This blocks unauthorised users from authenticating even if they can see the app. Review assignments regularly and remove broad group membership that expands access beyond the intended population.
What “assigned only” means in Microsoft Entra
The restriction works by making the application available only to an explicit set of assigned users or groups, then enforcing assignment before sign-in is allowed. In practice, the app can still exist in the tenant and be visible in places like My Apps, but authentication is denied unless the user is on the approved assignment list.
This is a control on application access, not just on app visibility. It is most effective when the assignment model is kept narrow, because broad group membership can quietly expand who can authenticate without changing the app itself.
For the Entra-side mechanics and consent-related pitfalls around enterprise apps, the Entra ID Applications and Consent Guide is a useful companion when you are reviewing how access, consent, and enterprise application exposure interact.
How to apply the restriction safely
Start by deciding whether the app should be assigned to individuals, a tightly scoped security group, or a managed access group. Then enable the application setting that requires assignment for access, and verify that only the intended users or groups are present on the app assignment list.
The practical test is simple: if a user is not assigned, they should fail at the authentication step for that application even if they can discover it in the portal. That makes assignment the enforcement point, not a documentation step.
If you are standardising access across a broader Entra estate, the Active Directory and Entra ID Hardening Guide gives the surrounding identity-hardening context, while the Azure RBAC and Service Principals Guide helps when the same governance model has to extend beyond user sign-in to privileged roles and service principals.
What to review when access should stay narrow
Most failures come from indirect access expansion rather than from the app setting itself. A user can inherit app access through a large group, a nested group structure, or a membership change that was made for some other business reason. That is why assignment reviews need to include the group structure behind the assignment, not just the app’s visible list of assignees.
Also check whether the application is configured for the right population. If it is meant for a small operational team, role-based groups are usually safer than broad departmental groups, because broad groups often accumulate users who no longer need access. The assignment control only works if the underlying group hygiene is equally disciplined.
When the risk is not just access breadth but also privileged or conditional access paths, the Privileged Identity Management (PIM) Guide is the better reference point for making access time-bound and reviewable.
Risk and Threat Considerations
Assigned-only access reduces accidental exposure, but it does not remove risk if the assigned population is too large or if a compromised account sits inside an allowed group. In that case, the application remains protected from the outside, yet still open to abuse from inside the approved set.
Failure mechanism: A user gains access through inherited group membership, stale assignment, or an overbroad access group, then authenticates legitimately to an application they should not effectively control or use.
Impact: Unauthorised users can reach business functions, view data, or exercise app permissions that were supposed to be limited to a smaller audience, creating access abuse and audit findings.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Restricting app access by assignment depends on managing who is authorized to use the app. |
| AC-6 — Least Privilege | The question is about limiting the app to only the minimum intended users. | |
| Recommendation — Restrict application access to approved accounts and review assigned access regularly. Limit application access to the smallest user set needed for the business function. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access Control | Entra app assignment is an access-control decision about who may authenticate to a service. |
| Recommendation — Apply access control rules so only approved users can sign in to the application. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | The control is about assigning and reviewing who can access an application. |
| Recommendation — Review application assignments and remove unnecessary access paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | The answer centers on restricting application access to an approved set of users. |
| Recommendation — Enforce approved assignment before allowing application sign-in. | ||
Practitioner Guidance
What to verify: Confirm both sides of the control, the app is set to require assignment, and the assignment list is limited to the true business population. If the only way a user can get access is through a large shared group, treat that group as part of the control surface and review it with the same rigour as the app itself.
Common mistake: Teams often assume the app is “restricted” once assignment is enabled, but the real exposure is usually hidden in group membership growth. Re-certify the assigned groups on a schedule, and remove any broad membership pattern that no longer matches the intended access model.
Practitioner takeaway: In Entra, the security boundary is not the app object alone, it is the combination of assignment enforcement and the membership hygiene behind every assigned group.
Related resources from NHI Mgmt Group
- How do you apply least privilege to application permissions in Microsoft Entra ID?
- How should security teams detect abuse of Microsoft application credentials in Entra ID before persistence is established?
- How do organisations simplify password resets for users who authenticate to privileged access systems with Microsoft Entra?
- What do teams get wrong when they try to restrict application permissions in Microsoft 365?