App registrations should no longer use secrets

Contributed by Stephan van RooijAll contributors →

Part of Maester · Entra ID · Applications · All checks

Run this check

Invoke-Maester -TestId MT.1057

Overview

This test checks if you have any app registrations that have secrets configured. Using secrets is discouraged! There are better ways available to authenticate your applications.

Remediation action

Open all app registrations below and remove the secrets.

Details

Every attribute of this check

Field	Value
Test ID	MT.1057
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Applications
Area	Applications and workload identities
Resource type	Application
User impact	Low
Implementation cost	High
MITRE ATT&CK	T1078.004 Cloud Accounts, T1552 Unsecured Credentials
Supports controls	nist-800-53-r5:IA-5
PowerShell test	Test-MtAppRegistrationsWithSecrets
Services	Graph
Long running	Yes

Source

• Test: tests/maester/entra/Test.MT.1057.ps1
• Documentation: tests/maester/entra/Test.MT.1057.md