Applications don't have certificates with expiration longer than 180 days
Overview
Section titled “Overview”Certificates, if not securely stored, can be extracted and exploited by attackers, leading to unauthorized access. Long-lived certificates are more likely to be exposed over time. Credentials, when exposed, provide attackers with the ability to blend their activities with legitimate operations, making it easier to bypass security controls. If an attacker compromises an application’s certificate, they can escalate their privileges within the system, leading to broader access and control, depending on the privileges of the application.
Remediation
Section titled “Remediation”- Define certificate based application configuration
- Define trusted certificate authorities for apps and service principals in the tenant
- Define application management policies
- Enforce secret and certificate standards
- Create a least-privileged custom role to rotate application credentials
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Application management |
| Product | Entra ID |
| Feature | Applications |
| Area | Applications and workload identities |
| ATT&CK | T1649 Steal or Forge Authentication Certificates, T1078.004 Cloud Accounts |
| Licence | Free |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.