Skip to main content
Version: 2.2.1-preview

MT.1208 - Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview)

Agnivesh S.
Contributed by Agnivesh S.All contributors →

Overview​

Agent Identity Blueprints should not have expired, excessive, or overly long-lived client credentials.

Credentials on Agent Identity Blueprints are used for token exchange to authenticate all child Agent Identities. If a blueprint accumulates expired secrets, secrets valid for years without rotation, or an excessive number of active secrets, the risk of credential compromise and unmanaged persistence increases significantly.

This check inspects the credential metadata of all Agent Identity Blueprints in the tenant to identify expired secrets, credentials valid for more than 730 days (2 years), blueprints with more than 2 active secrets, or a blueprint that retains an active client secret alongside a federated identity credential (FIC).

Remediation action:​

  1. Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent blueprints.
  2. Locate the reported Blueprint using its Object ID or display name.
  3. Under Developer settings, select Credentials.
  4. On the Certificates and Client secrets tabs, delete any expired credentials that are no longer in use.
  5. If secrets have validity periods longer than your organization's maximum rotation window (recommended ≤ 365–730 days), create a new secret and decommission the old one.
  6. Prefer using Federated credentials or Certificates instead of shared client secrets wherever supported. If a federated credential is already configured, remove the remaining client secret entirely rather than keeping it as a fallback.

Test Metadata​

FieldValue
Test IDMT.1208
SeverityHigh
SuiteMaester
CategoryEntra
PowerShell testTest-MtEntraAgentBlueprintCredentialHygiene
TagsEntra, Graph, LongRunning, Maester, MT.1208, Preview, Severity:High

Source​

  • Pester test: tests/Maester/Entra/Test-MtEntraAgentSecurity.Tests.ps1
  • PowerShell source: powershell/public/maester/entra/Test-MtEntraAgentBlueprintCredentialHygiene.ps1