Microsoft services applications don't have credentials configured

Overview

Microsoft services applications that operate in your tenant are identified as service principals with the owner organization ID “f8cdef31-a31e-4b4a-93e4-5f571e91255a.” When these service principals have credentials configured in your tenant, they might create potential attack vectors that threat actors can exploit. If an administrator added the credentials and they’re no longer needed, they can become a target for attackers. Although less likely when proper preventive and detective controls are in place on privileged activities, threat actors can also maliciously add credentials. In either case, threat actors can use these credentials to authenticate as the service principal, gaining the same permissions and access rights as the Microsoft service application. This initial access can lead to privilege escalation if the application has high-level permissions, allowing lateral movement across the tenant. Attackers can then proceed to data exfiltration or persistence establishment through creating other backdoor credentials.

When credentials (like client secrets or certificates) are configured for these service principals in your tenant, it means someone - either an administrator or a malicious actor - enabled them to authenticate independently within your environment. These credentials should be investigated to determine their legitimacy and necessity. If they’re no longer needed, they should be removed to reduce the risk.

If this check doesn’t pass, the recommendation is to “investigate” because you need to identify and review any applications with unused credentials configured.

Remediation

• Confirm if the credentials added are still valid use cases. If not, remove credentials from Microsoft service applications to reduce security risk.
  • In the Microsoft Entra admin center, browse to Entra ID > App registrations and select the affected application.
  • Go to the Certificates & secrets section and remove any credentials that are no longer needed.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Identity
Category	Application management
Product	Entra ID
Feature	Applications
Area	Applications and workload identities
ATT&CK	T1098.001 Additional Cloud Credentials, T1078.004 Cloud Accounts
Licence	Free
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.