# All certificates Microsoft Entra Application Registrations and Service Principals must be issued by an approved certification authority
All certificates Microsoft Entra Application Registrations and Service Principals must be issued by an approved certification authority: a Microsoft Zero…
Source: https://maester.dev/docs/tests/ZTA.21894
## Overview
Microsoft has not published a description of this check yet.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Low |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Applications |
| Area | Applications and workload identities |
| ATT&CK | [T1649](/docs/tests?mitre=T1649) Steal or Forge Authentication Certificates, [T1098.001](/docs/tests?mitre=T1098.001) Additional Cloud Credentials |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.