# App registration certificates should not have excessive validity periods

This test checks if any app registration uses a certificate that was issued with an excessive validity period.

Source: https://maester.dev/docs/tests/MT.1198

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/simon-vedder" title="Simon Vedder · Original author"><img src="https://github.com/simon-vedder.png" alt="Simon Vedder" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/simon-vedder">Simon Vedder</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Applications · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1198
```

## Overview

This test checks if any app registration uses a certificate that was issued with an excessive validity period.

Certificates are the recommended alternative to client secrets, but a certificate that is valid for several years reintroduces the risk it was meant to remove: a stolen private key stays usable for the entire remaining validity period, and long-lived credentials are rarely rotated or reviewed.

An app management policy does not close this gap on its own. Credential restrictions carry a `restrictForAppsCreatedAfterDateTime` property and only apply to credentials added after the policy takes effect, so certificates that already exist are grandfathered in and are never re-evaluated. A tenant can therefore pass the app management policy test and still authenticate with multi-year certificates.

Certificates that have already expired can no longer be used to authenticate and are not reported by this test.

#### Remediation action

1. Open the app registration listed below in the [Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) and select **Certificates & secrets**.
2. Request or generate a replacement certificate with a shorter validity period and upload it under **Certificates**.
3. Update the workload that authenticates with the app registration to use the new certificate.
4. Once the workload has been confirmed to work, delete the long-lived certificate.
5. Configure the [default app management policy](https://learn.microsoft.com/graph/api/resources/tenantappmanagementpolicy) with an `asymmetricKeyLifetime` restriction so that new certificates cannot be added with an excessive validity period.
6. Where possible, replace certificate authentication with a [managed identity](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview) or [workload identity federation](https://learn.microsoft.com/entra/workload-id/workload-identity-federation), which removes the credential entirely.

## Learn more

- [Microsoft Entra application management policies API overview](https://learn.microsoft.com/graph/api/resources/applicationauthenticationmethodpolicy)
- [Tenant app management policy - Microsoft Graph reference](https://learn.microsoft.com/graph/api/resources/tenantappmanagementpolicy)
- [Workload identity federation](https://learn.microsoft.com/entra/workload-id/workload-identity-federation)
- [Microsoft Entra recommendation: Remove unused credentials from applications](https://learn.microsoft.com/entra/identity/monitoring-health/recommendation-remove-unused-credential-from-apps)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1198 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Applications |
| Area | Applications and workload identities |
| Resource type | Application |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1649 Steal or Forge Authentication Certificates |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | [Test-MtAppRegistrationCertificateLifetime](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1198.ps1) |
| Services | Graph |
| Long running | Yes |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1198.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1198.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1198.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1198.md)