MT.1199 - App registration credentials should not be expired or expiring soon.
Overview
This test checks if any app registration has a certificate or secret that is expired or about to expire.
An expired credential can no longer authenticate, but it stays on the app registration until someone removes it. Expired credentials accumulate over time, obscure which credential a workload actually uses, and make it harder to notice one that was added by an attacker. Microsoft Entra recommends removing unused credentials from applications for exactly that reason.
A credential that is about to expire is the same problem shortly before it happens. The workload keeps running until the credential lapses, and the resulting outage arrives without warning — usually outside office hours, and usually on the integration nobody documented.
Both credential types are reported. Certificates are the recommended alternative to secrets, but they expire just as silently, and an app registration that still uses secrets is reported here as well so that a single view covers everything that is about to lapse.
Remediation action
- Open the app registration listed below in the Microsoft Entra admin center and select Certificates & secrets.
- For a credential that is about to expire, upload or generate a replacement, update the workload that authenticates with it, and confirm the workload works with the new credential.
- Delete the expired or replaced credential once it is no longer in use.
- If the app registration is no longer used at all, remove the application instead of renewing its credentials.
- Where possible, replace the credential with a managed identity or workload identity federation, neither of which expires.
Learn more
- Microsoft Entra recommendation: Remove unused credentials from applications
- Workload identity federation
- Managed identities for Azure resources
- application resource type - Microsoft Graph reference
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1199 |
| Severity | Medium |
| Suite | Maester |
| Category | App |
| PowerShell test | Test-MtAppRegistrationCredentialExpiry |
| Tags | App, Entra, Graph, LongRunning, Maester, MT.1199 |
Source
- Pester test:
tests/Maester/Entra/Test-AppRegistrations.Tests.ps1 - PowerShell source:
powershell/public/maester/entra/Test-MtAppRegistrationCredentialExpiry.ps1