Question

Your organization wants a group of application owners to be able to create and manage app registrations, but they must NOT be able to modify any other directory objects. The existing built-in roles grant either too many or too few permissions. You need to grant exactly the required permissions using the principle of least privilege. What should you do?

Accepted Answer

Create a custom role with only the microsoft.directory/applications permissions and assign it to the application owners.

Answer

Assign the Application Administrator built-in role to each application owner.

Answer

Assign the Cloud Application Administrator built-in role scoped to an administrative unit.

Answer

Add the application owners to the Global Administrator role and use Conditional Access to restrict their actions.