Developers in a water-lab tenant can register new apps and immediately request Microsoft Graph permissions. Which tenant setting should the security engineer tighten so only authorized administrators can create app registrations?
Select an answer to reveal the explanation.
Short Explanation
If every lab tech can mint a new app registration, you have a self-serve permission factory. Flip the tenant switch that lets users register applications off, and leave registration to Application Administrators or the group you designate.
Full Explanation
Microsoft Entra user settings include whether users can register applications. Disabling that setting restricts app-registration creation to administrators (such as Application Administrator) or other allowed actors. Blocking all portal sign-ins with Conditional Access or deleting directory roles is disproportionate and breaks operations. Security Copilot is out of scope for AZ-500 and is not the control for this tenant setting.