User app registration - exploitable for BEC?

Hi underQualifried 
Firstly, well done on what you have done so far in your investigations, it's not easy and as an Admin, you have to embark on a massive learning journey to understand what is possible in Entra ID before you can understand the risks and how to mitigate them.

With that said, you do most definitely want to restrict what standard users can do with regards to application registrations, and consenting to permissions for enterprise apps that request access. Some admins go so far as to block user consent altogether as well as blocking app registration.

Because this is a common concern for Microsoft 365 tenant admins at the moment due to recent attacks like Midnight Blizzard, I wrote a two-part blog to help admins that are not app developers understand the risks and I made some recommendations. Check it out:

Part 1: Entra ID Application consent - what identity admins need to know

Part 2: Entra ID Application consent - recommendations

Hope this helps

Matt