{
  "id": "CIS-ENTRA-1.1.1",
  "title": "Ensure 'Users can register applications' is set to 'No'",
  "level": 1,                              // CIS L1 | L2 (absent pour SCuBA)
  "method": "automated",                   // automated | manual
  "severity": "high",                      // critical | high | medium | low

  // Un seul des blocs `graph` ou `cmdlet` selon le provider
  "graph": {
    "apiVersion": "v1.0",                  // v1.0 | beta
    "endpoint": "/policies/authorizationPolicy",
    "check": {
      "property": "defaultUserRolePermissions.allowedToCreateApps",
      "operator": "eq",
      "expected": false
    }
  },
  "cmdlet": {
    "module": "ExchangeOnlineManagement",  // ExchangeOnlineManagement | MicrosoftTeams | PnP.PowerShell
    "cmdlet": "Get-OrganizationConfig",
    "property": "AuditDisabled",
    "expected": false
  },

  "remediation": {
    "instructions": "...",
    "portalUrl": "https://entra.microsoft.com/...",
    "graphSetUrl": "https://..."
  },

  "mappings": {
    "cis": "1.1.1",
    "iso27001": "A.5.15",
    "nistCsf2": "PR.AC-01"
  },

  "requiredPermissions": ["Policy.Read.All"],
  "requiredLicense": null,                 // ex: "AAD_PREMIUM_P2"

  "applicability": {
    "hybridOnly": false,                   // true → not_applicable si cloud-only
    "cloudOnly": false
  },

  "manualValidation": {                    // obligatoire si method=manual
    "steps": ["...", "..."],
    "expectedState": "...",
    "references": ["CIS §1.1.1", "ANSSI-PSSI §4.2"]
  }
}