# Ensure that 'Users can add gallery apps to My Apps' is set to 'No'

- Source: https://support.icompaas.com/support/solutions/articles/62000219688-ensure-that-users-can-add-gallery-apps-to-my-apps-is-set-to-no-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [1. Identity and Access Management](https://support.icompaas.com/support/solutions/folders/62000167544)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This setting controls whether users in the organization are allowed to add applications from the Azure AD / Microsoft Entra ID application gallery directly to their My Apps portal. Allowing end users to add gallery apps themselves may introduce unauthorized or unapproved applications into the environment, which can increase security risk, reduce governance control, and bypass application onboarding processes.

  

Rationale:

Disabling this feature ensures users cannot independently assign or add applications without administrator approval. This helps maintain proper governance, prevents unauthorized app usage, and reduces the risk of users granting permissions to malicious or overly permissive applications. Enforcing centralized control aligns with application lifecycle management and security best practices.

  

Impact:

Restricting users from adding gallery apps ensures better access governance and reduces security risks. However, users may experience reduced flexibility in self-service application use.

  

Default Value:

By default, users may be allowed to add gallery apps unless explicitly disabled by administrators.

  

Pre-Requisites:

-   Microsoft Entra ID (Azure AD) administrator permissions
    
-   Access to the Azure Portal
    

  

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Microsoft Entra ID
    
3.  Under the Manage section, select Enterprise applications
    
4.  Under Manage, select User settings
    
5.  Verify that Users can add gallery apps to My Apps is set to No
    
6.  If Users can add gallery apps to My Apps is not set to No, follow the implementation steps
    

  

Implementation Steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Microsoft Entra ID
    
3.  Under the Manage section, select Enterprise applications
    

                 ![](https://support.icompaas.com/assets/kb/bc408c32aa60fc59.png)

4.  Under the Mange Select, User settings.
    

                              ![](https://support.icompaas.com/assets/kb/572dfe3f196f0aa7.png)

5.  Set Users can add gallery apps to My Apps to No
    
6.  Save the changes
    

  

Backout Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Microsoft Entra ID
    
3.  Under the Manage section, select Enterprise applications
    
4.  Under Manage, Select User settings
    
5.  Set Users can add gallery apps to My Apps to Yes
    
6.  Save the changes
    

  

Reference:

-   [https://learn.microsoft.com/azure/active-directory/manage-apps/add-application-portal](https://learn.microsoft.com/azure/active-directory/manage-apps/add-application-portal)
    

[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-1-define-asset-management-and-data-protection-strategy "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-1-define-asset-management-and-data-protection-strategy")**[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-1-define-asset-management-and-data-protection-strategy "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-1-define-asset-management-and-data-protection-strategy")**

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.