# Service principals don't have certificates or credentials associated with them
Service principals without proper authentication credentials (certificates or client secrets) create security vulnerabilities that allow threat actors to…
Source: https://maester.dev/docs/tests/ZTA.21896
## Overview
Service principals without proper authentication credentials (certificates or client secrets) create security vulnerabilities that allow threat actors to impersonate these identities. This can lead to unauthorized access, lateral movement within your environment, privilege escalation, and persistent access that's difficult to detect and remediate.
## Remediation
- For your organization's service principals: [Add certificates or client secrets to the app registration](https://learn.microsoft.com/entra/identity-platform/how-to-add-credentials?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- For external service principals: Review and remove any unnecessary credentials to reduce security risk
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Applications |
| Area | Applications and workload identities |
| ATT&CK | [T1098.001](/docs/tests?mitre=T1098.001) Additional Cloud Credentials |
| Licence | Free |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.