rules/findings/old/entraid/Applications/CIS3.1/eid-application-with-long-lived-certificate-credentials.json
|
{
"provider": "EntraID", "serviceType": "Applications", "serviceName": "Microsoft Entra ID", "displayName": "Ensure client certificates are rotated from application registration", "description": "Whilst certificate-based authentication represents a significant security improvement over client secret (password credential) authentication, excessively long certificate validity periods introduce substantial security risks that undermine the cryptographic advantages certificates provide.\r\nLong-lived certificates create extended windows of vulnerability during which compromised private keys remain valid for authentication, enabling attackers to maintain persistent unauthorised access to resources and data that the application's service principal has been granted permissions to access.", "rationale": "Certificate credentials with extended validity periods fundamentally contradict the security principle of credential rotation and time-limited access. When organisations issue certificates with multi-year lifespans, they effectively create standing authentication credentials that persist across lengthy periods during which security contexts, threat landscapes, organisational requirements, and application architectures may significantly change. Unlike short-lived certificates that force regular renewal and validation cycles, long-lived certificates enable organisations to defer credential lifecycle management activities indefinitely, resulting in forgotten certificates, undocumented authentication dependencies, and orphaned credentials that remain valid long after applications have been decommissioned or migrated to alternative authentication mechanisms.", "impact": "Long-lived certificates create significant detection and response challenges. When certificates remain valid for multiple years, organisations lose the forcing function that regular credential rotation provides for validating application authentication patterns, reviewing service principal permissions, and confirming that authentication credentials are still required for legitimate business purposes. The infrequent renewal cycles associated with long-lived certificates mean that security teams rarely review which applications possess authentication credentials, what permissions those applications have been granted, and whether the original business justification for those permissions still applies.", "remediation": { "text": " ###### To remediate using the UI: 1. Navigate to the [Microsoft Entra admin centre](https://entra.microsoft.com/) and sign in with appropriate administrative permissions 2. Browse to **Identity** > **Applications** > **App registrations** 3. Select **All applications** from the view selector to display all application registrations 4. Locate and select the application requiring certificate replacement 5. Select **Certificates & secrets** from the left navigation menu 6. Review existing certificates listed under the **Certificates** tab and identify those with extended validity periods ", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity-platform/certificate-credentials", "https://learn.microsoft.com/en-us/entra/identity-platform/security-best-practices-for-app-registration", "https://learn.microsoft.com/en-us/azure/key-vault/certificates/overview-renew-certificate?tabs=azure-portal", "https://learn.microsoft.com/en-us/entra/workload-id/workload-identities-overview" ], "compliance": [ { "name": "Monkey365 Entra", "version": "0.0.1", "reference": "5.3.1", "profile": [ ] } ], "level": "medium", "tags": [ ], "rule": { "path": "aad_app_registrations", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "keyCredentials.Count", "gt", "0" ] ] } ] }, { "connectOperator":"and", "filter": [ { "conditions": [ [ "expireInDays", "gt", "_ARG_0_" ] ], "whereObject":"keyCredentials" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "Id", "appId": "Application Id", "displayName": "Application Name" }, "expandObject": null }, "table": "default", "table": null, "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": false, "showModalButton": true, "directLink": null } }, "text": { "data": { "properties": { "id": "Id", "appId": "Application Id", "displayName": "Application Name" }, "expandObject": null }, "status": { "keyName": [ "displayName" ], "message": "Ensure client certificates are rotated from {displayName}", "defaultMessage": "Ensure client certificates are rotated from application registration" }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraApplication" }, "onlyStatus": false } }, "idSuffix": "aad_applications_with_long_lived_cert_password_present", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "entraid_1174" } |