How to find app registrations without owners in Entra ID

Before you start

Use an account in a role that can list applications, such as Global Reader, Security Administrator, Cloud Application Administrator or Application Administrator. The PowerShell example requests Application.Read.All, the least privileged permission for listing applications; your organisation may require administrator consent.

Know what the list covers. It is the app registrations made in this tenant. Enterprise applications, including those of apps other organisations publish, have owners of their own and are left out. The owner filter is an advanced query that uses an index, which might not be up to date with very recent changes. The examples read and export; they don't add or remove any owner.

Option 1

Find app registrations without owners with PowerShell

Install the modules once, then connect and export the app registrations with no owner. The owner count filter runs in Microsoft Graph, so only ownerless apps come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Applications -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'Application.Read.All' -NoWelcome
try {
    # A filter on the owner count is an advanced query: it needs ConsistencyLevel and a count.
    $query = @{
        Filter           = 'owners/$count eq 0'
        ConsistencyLevel = 'eventual'
        CountVariable    = 'ownerlessCount'
        Property         = 'id', 'appId', 'displayName', 'createdDateTime', 'signInAudience',
            'passwordCredentials', 'keyCredentials'
    }
    $apps = @(Get-MgApplication -All @query)
    $report = @($apps | Sort-Object DisplayName | ForEach-Object {
        [pscustomobject]@{
            Application    = $_.DisplayName
            AppId          = $_.AppId
            Created        = $_.CreatedDateTime
            SignInAudience = $_.SignInAudience
            Secrets        = @($_.PasswordCredentials).Count
            Certificates   = @($_.KeyCredentials).Count
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'Every app registration has at least 1 owner.'
    } else {
        $report | Export-Csv -Path './apps-without-owners.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) app registrations have no owner."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script keeps each ownerless app's name, application ID, creation date and sign-in audience, with how many secrets and certificates it holds. Start with the apps that hold any, and check their end dates. Change the filter to owners/$count eq 1 to list the apps 1 departure away from none.

Option 2

Check app owners in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > App registrations and select the application.
3. Under Manage, select Owners. An empty list means the app has no owner.
4. Leave without adding or removing an owner.

This suits checking 1 app you already have in mind. The admin centre shows owners 1 app at a time, so to find every app registration without one, use PowerShell or a report.

Common questions

Does an app owned only by a service principal count as ownerless?

No. An application's owners can be users, its own service principal or another service principal, and the filter counts them all. Run the single-app check in the admin centre to see who or what owns it.

Why doesn't my API appear when I add API permissions?

Microsoft says both the API's app registration and the app you are adding permissions to need an owner; otherwise the API isn't listed when you request API permissions. An ownerless API on this list explains it.

How do I see which ownerless apps have expiring secrets?

Read the end dates of each app's secrets and certificates. See how to find expiring app secrets, and how to review app permissions for what each app can reach.