Test-MtAppRegistrationCertificateLifetime
SYNOPSIS
Check if app registrations use certificates that are issued with an excessive validity period.
SYNTAX
Test-MtAppRegistrationCertificateLifetime [[-MaximumValidityDays] <Int32>] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
DESCRIPTION
App management policies only constrain credentials that are added after the policy takes effect. The restrictForAppsCreatedAfterDateTime property means certificates that already exist are grandfathered in and are never re-evaluated, so a tenant can have an app management policy enabled and still authenticate with multi-year certificates.
This test inspects the certificates (keyCredentials) of every app registration and reports the ones whose validity period exceeds the maximum. Certificates that have already expired can no longer be used to authenticate and are not reported.
EXAMPLES
EXAMPLE 1
Test-MtAppRegistrationCertificateLifetime
Returns true if no app registration uses a certificate that is valid for more than 365 days.
EXAMPLE 2
Test-MtAppRegistrationCertificateLifetime -MaximumValidityDays 90
Returns true if no app registration uses a certificate that is valid for more than 90 days.
PARAMETERS
-MaximumValidityDays
Longest validity period, in days, that a certificate may be issued for. Defaults to 365 days, which matches the asymmetricKeyLifetime of the sample app management policy documented in Test-MtAppManagementPolicyEnabled.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 1
Default value: 365
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
INPUTS
OUTPUTS
System.Boolean
NOTES
RELATED LINKS
https://maester.dev/docs/commands/Test-MtAppRegistrationCertificateLifetime