Skip to main content
Version: 2.2.0

Test-MtAppRegistrationCredentialExpiry

SYNOPSIS​

Check if app registrations have credentials that are expired or about to expire.

SYNTAX​

Test-MtAppRegistrationCredentialExpiry [[-ExpiringWithinDays] <Int32>] [-ProgressAction <ActionPreference>]
 [<CommonParameters>]

DESCRIPTION​

An expired certificate or secret can no longer authenticate, but it stays on the app registration until someone removes it. Expired credentials accumulate, obscure which credential a workload actually uses, and make it harder to spot one that was added by an attacker. Microsoft Entra recommends removing unused credentials from applications.

A credential that is about to expire is the same problem shortly before it happens: the workload keeps running until the credential lapses, and the outage arrives without warning.

This test inspects the certificates (keyCredentials) and secrets (passwordCredentials) of every app registration and reports the ones that have already expired or that expire within the next ExpiringWithinDays days.

EXAMPLES​

EXAMPLE 1​

Test-MtAppRegistrationCredentialExpiry

Returns true if no app registration has a credential that is expired or expires within 30 days.

EXAMPLE 2​

Test-MtAppRegistrationCredentialExpiry -ExpiringWithinDays 7

Returns true if no app registration has a credential that is expired or expires within 7 days.

PARAMETERS​

-ExpiringWithinDays​

Number of days ahead to look for credentials that are about to expire. Defaults to 30 days, matching the threshold used by Test-MtApplePushNotificationCertificate.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: 30
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtAppRegistrationCredentialExpiry