MT.1198 - App registration certificates should not have excessive validity periods.
Overview
This test checks if any app registration uses a certificate that was issued with an excessive validity period.
Certificates are the recommended alternative to client secrets, but a certificate that is valid for several years reintroduces the risk it was meant to remove: a stolen private key stays usable for the entire remaining validity period, and long-lived credentials are rarely rotated or reviewed.
An app management policy does not close this gap on its own. Credential restrictions carry a restrictForAppsCreatedAfterDateTime property and only apply to credentials added after the policy takes effect, so certificates that already exist are grandfathered in and are never re-evaluated. A tenant can therefore pass the app management policy test and still authenticate with multi-year certificates.
Certificates that have already expired can no longer be used to authenticate and are not reported by this test.
Remediation action
- Open the app registration listed below in the Microsoft Entra admin center and select Certificates & secrets.
- Request or generate a replacement certificate with a shorter validity period and upload it under Certificates.
- Update the workload that authenticates with the app registration to use the new certificate.
- Once the workload has been confirmed to work, delete the long-lived certificate.
- Configure the default app management policy with an
asymmetricKeyLifetimerestriction so that new certificates cannot be added with an excessive validity period. - Where possible, replace certificate authentication with a managed identity or workload identity federation, which removes the credential entirely.
Learn more
- Microsoft Entra application management policies API overview
- Tenant app management policy - Microsoft Graph reference
- Workload identity federation
- Microsoft Entra recommendation: Remove unused credentials from applications
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1198 |
| Severity | Medium |
| Suite | Maester |
| Category | App |
| PowerShell test | Test-MtAppRegistrationCertificateLifetime |
| Tags | App, Entra, Graph, LongRunning, Maester, MT.1198 |
Source
- Pester test:
tests/Maester/Entra/Test-AppRegistrations.Tests.ps1 - PowerShell source:
powershell/public/maester/entra/Test-MtAppRegistrationCertificateLifetime.ps1