MT.1002 - App management restrictions on applications and service principals is configured and enabled.

Contributed by Fabian Bader with 2 co-contributorsAll contributors →

Overview

By default Microsoft Entra ID allows service principals and applications to be configured with weak credentials.

This can include

• client secrets instead of certificates
• secrets and certificates with long expiry (e.g. 10 year)

How to fix

Using shorter expiry periods and certificates instead of secrets can help reduce the risk of credentials being compromised and used by an attacker.

The sample policy below can be used to enforce credential configurations on apps and service principals.

Import-Module Microsoft.Graph.Identity.SignIns

$params = @{
isEnabled = $true
applicationRestrictions = @{
    passwordCredentials = @(
    @{
        restrictionType = "passwordAddition"
        maxLifetime = $null
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2021-01-01T10:37:00Z")
    }
    @{
        restrictionType = "passwordLifetime"
        maxLifetime = "P365D"
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2017-01-01T10:37:00Z")
    }
    @{
        restrictionType = "symmetricKeyAddition"
        maxLifetime = $null
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2021-01-01T10:37:00Z")
    }
    @{
        restrictionType = "customPasswordAddition"
        maxLifetime = $null
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2015-01-01T10:37:00Z")
    }
    @{
        restrictionType = "symmetricKeyLifetime"
        maxLifetime = "P365D"
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2015-01-01T10:37:00Z")
    }
    )
    keyCredentials = @(
    @{
        restrictionType = "asymmetricKeyLifetime"
        maxLifetime = "P365D"
        restrictForAppsCreatedAfterDateTime = [System.DateTime]::Parse("2015-01-01T10:37:00Z")
    }
    )
}
}

Update-MgPolicyDefaultAppManagementPolicy -BodyParameter $params

Learn more

• Tenant App Management Policy - Microsoft Graph Reference
• What are Workload ID Premium features, and which are free?
• Microsoft Entra application management policies API overview

Test Metadata

Field	Value
Test ID	MT.1002
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Applications
Area	Applications and workload identities
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1098.001 Additional Cloud Credentials, T1552 Unsecured Credentials
PowerShell test	Test-MtAppManagementPolicyEnabled
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1002.ps1
• Documentation: tests/maester/entra/Test.MT.1002.md