rules/findings/old/entraid/Applications/CIS3.1/eid-enterprise-apps-max-password-lifetime-not-enabled.json
|
{
"provider": "EntraID", "serviceType": "Applications", "serviceName": "Microsoft Entra ID", "displayName": "Ensure password lifetime for applications does not exceed 180 days", "description": "In Microsoft Entra ID, applications and service principals can authenticate using password credentials (also referred to as client secrets). This setting enforces a tenantwide maximum lifetime for new password credentials added to any application registration or service principal. When enabled, any client secret created must have an expiration date that falls within the configured maximum, which for this recommendation is 180 days or less. The policy is implemented through the default app management policy and applies to all applications unless scoped exceptions are configured.\r\n The setting does not retroactively shorten or invalidate existing password credentials; secrets created before the policy was enabled remain valid until they expire or are explicitly removed.\r\nThe recommended state is **Restrict max password lifetime** set to **On: 180 days** or less.", "rationale": "Long-lived client secrets extend the window of exploitation if a credential is compromised. A secret valid for multiple years that is never rotated remains usable even if it was leaked in source code, a build log, or a security breach long after the initial exposure. Enforcing a maximum lifetime of 180 days ensures that client secrets expire on a regular basis, limiting the period during which a stolen credential remains valid and reducing the blast radius of a compromise. This control also encourages teams to establish automated rotation practices, which further reduces reliance on static, longlived credentials.", "impact": "Any automated process, pipeline, or script that creates client secrets with a lifetime exceeding the configured maximum will fail once the policy is enabled, unless an exception is configured. Organizations will need to update secret creation workflows to specify expiration dates within the allowed range and establish rotation processes for secrets approaching expiry.", "remediation": { "text": " #### Remediate from Entra ID 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Entra ID and select Enterprise apps 3. Under Security select Application policies. 4. Select Restrict max password lifetime. 5. Set Status to On. 6. Set the maximum lifetime to 180 days or less. 7. Set Applies to to one of the following: * All applications * All applications with exclusions (if using exclusions, ensure they are reviewed annually). 8. Set Only apply to apps created after to a desired date or leave it unconfigured. 9. Select Save and close to apply the changes. ", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies?tabs=portal", "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-enforce-secret-standards?pivots=ms-graph", "https://learn.microsoft.com/en-us/graph/api/resources/tenantappmanagementpolicy?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/entra/fundamentals/zero-trust-protect-identities#enforce-standards-for-app-secrets-and-certificates" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "7.0.0", "reference": "5.1.5.4", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "aad_default_app_management_policy", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "applicationRestrictions.passwordCredentials.Count", "eq", 0 ], [ "servicePrincipalRestrictions.passwordCredentials.Count", "eq", 0 ] ], "operator": "or" } ] }, { "connectOperator":"or", "filter": [ { "conditions": [ [ "restrictionType", "eq", "passwordLifetime" ], [ "state", "eq", "disabled" ] ], "operator": "and", "whereObject":"applicationRestrictions.passwordCredentials" } ] }, { "connectOperator":"or", "filter": [ { "conditions": [ [ "restrictionType", "eq", "passwordLifetime" ], [ "state", "eq", "disabled" ] ], "operator": "and", "whereObject":"servicePrincipalRestrictions.passwordCredentials" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "Id", "displayName": "displayName", "description": "description", "isEnabled": "isEnabled" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "id": "Id", "displayName": "displayName", "description": "description", "isEnabled": "isEnabled" }, "expandObject": null }, "status": { "keyName": [], "message": "Ensure password lifetime for applications does not exceed 180 days", "defaultMessage": "Ensure password lifetime for applications does not exceed 180 days" }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraDefaultAppManagementPolicy" }, "onlyStatus": false } }, "idSuffix": "eid_enterprise_apps_password_lifetime_disabled", "notes": [], "categories": [], "immutable_properties": [ "id", "displayName" ], "id": "entraid_applications_004" } |