Service principals don't have certificates or credentials associated with them
Overview
Section titled “Overview”Service principals without proper authentication credentials (certificates or client secrets) create security vulnerabilities that allow threat actors to impersonate these identities. This can lead to unauthorized access, lateral movement within your environment, privilege escalation, and persistent access that’s difficult to detect and remediate.
Remediation
Section titled “Remediation”- For your organization’s service principals: Add certificates or client secrets to the app registration
- For external service principals: Review and remove any unnecessary credentials to reduce security risk
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | Entra ID |
| Feature | Applications |
| Area | Applications and workload identities |
| ATT&CK | T1098.001 Additional Cloud Credentials |
| Licence | Free |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.