App management restrictions on applications and service principals is configured and enabled

Contributed by Fabian Bader with 2 co-contributorsAll contributors →

Part of Maester · Entra ID · Applications · All checks

Run this check

Invoke-Maester -TestId MT.1002

Overview

By default Microsoft Entra ID allows service principals and applications to be configured with weak credentials.

This can include

• client secrets instead of certificates
• secrets and certificates with long expiry (e.g. 10 year)

How to fix

Using shorter expiry periods and certificates instead of secrets can help reduce the risk of credentials being compromised and used by an attacker.

The sample policy below can be used to enforce credential configurations on apps and service principals.

Import-Module Microsoft.Graph.Identity.SignIns

$params = @{
isEnabled = $true
applicationRestrictions = @{
    passwordCredentials = @(
    @{
        restrictionType = "passwordAddition"
        maxLifetime = $null
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2021-01-01T10:37:00Z")
    }
    @{
        restrictionType = "passwordLifetime"
        maxLifetime = "P365D"
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2017-01-01T10:37:00Z")
    }
    @{
        restrictionType = "symmetricKeyAddition"
        maxLifetime = $null
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2021-01-01T10:37:00Z")
    }
    @{
        restrictionType = "customPasswordAddition"
        maxLifetime = $null
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2015-01-01T10:37:00Z")
    }
    @{
        restrictionType = "symmetricKeyLifetime"
        maxLifetime = "P365D"
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2015-01-01T10:37:00Z")
    }
    )
    keyCredentials = @(
    @{
        restrictionType = "asymmetricKeyLifetime"
        maxLifetime = "P365D"
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2015-01-01T10:37:00Z")
    }
    )
}
}

Update-MgPolicyDefaultAppManagementPolicy -BodyParameter $params

Learn more

• Tenant App Management Policy - Microsoft Graph Reference
• What are Workload ID Premium features, and which are free?
• Microsoft Entra application management policies API overview

Details

Every attribute of this check

Field	Value
Test ID	MT.1002
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Applications
Area	Applications and workload identities
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1098.001 Additional Cloud Credentials, T1552 Unsecured Credentials
PowerShell test	Test-MtAppManagementPolicyEnabled
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1002.ps1
• Documentation: tests/maester/entra/Test.MT.1002.md