Want to grant ready only permission to a particular user to a App registration.

Question

Want to grant ready only permission to a particular user to a App registration.

H, Raghunandan 20

Wanted to grant ready only permission to a particular user to an App registration. User should be able to view only particular App registrations. Not all the app registrations.

For this

I created new Entra id custom role "App Registration Viewer"
Set permissions "microsoft.directory/applications/standard/read"
Then under the particular App registrations - Roles and administrator - Add assignment - added particular user account.

Now user is able to view (read) all the App registrations and its settings.

Please note user is a member user under Entra ID. And "Users can register applications" was set to "No" under Entra ID User settings

Could you please let us know is there a way to restrict user viewing other App registrations?

regards,

Raghunandan

H, Raghunandan 20 Reputation points

2026-09-18T11:58:26.67+00:00

Any guidance on this issue would be appreciated.

Answer accepted by question author

0 additional answers

Your answer

H, Raghunandan 20 Reputation points

2026-09-18T11:58:26.67+00:00

Any guidance on this issue would be appreciated.

Answer 1

Hi @H, Raghunandan - Not with any of the documented options, and it's worth walking through each one because the custom role was never the thing giving your user visibility.

Member users already have this. Default user permissions lists that they can "Enumerate the list of all applications" and "Read properties of registered and enterprise applications," with no role assigned at all. So your user could see every app registration before you created anything.

That's why the scoping didn't do what you expected. Roles add permissions, they don't take away the baseline ones, so a read only role on a single app has nothing to narrow. The "Users can register applications" setting doesn't reach it either, since the same page describes it as preventing users "from creating application registrations," which is creation rather than read.

As for turning the baseline off, that page also has a table of what you can restrict for member users. It covers registering applications, LinkedIn connections, creating security groups, creating Microsoft 365 groups, admin center access, tenant creation, and reading other users. Reading applications isn't on it.

Two other things look promising and neither holds up. Restrict access to the Microsoft Entra administration portal is described in the docs as adding friction rather than security: "It is not a security measure," most pages "remain reachable if the user has a direct (deep) link," and it "does not block programmatic access to Microsoft Entra data via PowerShell, Microsoft Graph API, or other tools like Visual Studio." And administrative units can't help because one "can contain only users, groups, or devices," so application objects can't be members.

One detail that explains the whole thing: on that comparison table, "Enumerate the list of all applications" appears only in the member user column. Guests and restricted guests get property reads without it. Listing every registration is part of the member baseline specifically, which is why there's no member-level switch to turn it off.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.

H, Raghunandan 20 Reputation points

2026-09-21T16:24:23.21+00:00

I accept the fact that Member users already have this. Default user permissions lists that they can "Enumerate the list of all applications" and "Read properties of registered and enterprise applications,"