rules/findings/old/entraid/Applications/CIS3.1/eid-enterprise-apps-password-addition-disabled.json
|
{
"provider": "EntraID", "serviceType": "Applications", "serviceName": "Microsoft Entra ID", "displayName": "Ensure password addition is blocked for applications", "description": "In Microsoft Entra ID, applications and service principals can authenticate using either certificate credentials or password credentials (also referred to as client secrets). This setting enforces a tenant-wide restriction that prevents new password credentials from being added to any application registration or service principal. The policy is implemented through the default app management policy and applies to all applications unless scoped exceptions are configured.\r\nThe setting does not revoke or invalidate existing password credentials; credentials created before the policy was enabled remain valid until they expire or are explicitly removed.\r\nThe recommended state is **Block password addition** set to **On**.", "rationale": "Password credentials (client secrets) used for application authentication are static string values that offer weaker security guarantees than certificate or federated credentials. Unlike certificates, client secrets carry no built-in proof of possession and are frequently stored in plaintext in source code, configuration files, CI/CD pipelines, and shell history. A leaked client secret grants any holder the ability to authenticate as the application to Microsoft Entra ID, potentially accessing any resource or permission scope assigned to that application.\r\nBlocking the addition of new password credentials eliminates this attack surface for applications created going forward and forces adoption of stronger credential types such as certificates.", "impact": "This policy applies to new password credential additions only. Existing client secrets remain valid until they expire or are explicitly revoked; this recommendation does not retroactively invalidate credentials created before the policy was enabled.\r\nAny automated process, pipeline, or script that programmatically adds client secrets to application registrations or service principals will be blocked once the policy is enabled, unless an exception is configured. Applications that have not yet migrated to certificatebased authentication or workload identity federation will require changes before new credentials can be added.", "remediation": { "text": " #### Remediate from Entra ID 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Entra ID and select Enterprise apps 3. Under Security select Application policies. 4. Select Block password addition. 5. Set Status to On. 6. Set Applies to to one of the following: * All applications * All applications with exclusions (if using exclusions, ensure they are reviewed annually). 7. Set Only apply to apps created after to a desired date or leave it unconfigured. 8. Select Save and close to apply the changes. ", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies?tabs=portal", "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-enforce-secret-standards?pivots=ms-graph", "https://learn.microsoft.com/en-us/graph/api/resources/tenantappmanagementpolicy?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/entra/fundamentals/zero-trust-protect-identities#enforce-standards-for-app-secrets-and-certificates" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "7.0.0", "reference": "5.1.5.3", "profile": [ "E3 Level 2", "E5 Level 2" ] } ], "level": "medium", "tags": [], "rule": { "path": "aad_default_app_management_policy", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "applicationRestrictions.passwordCredentials.Count", "eq", 0 ], [ "servicePrincipalRestrictions.passwordCredentials.Count", "eq", 0 ] ], "operator": "or" } ] }, { "connectOperator":"or", "filter": [ { "conditions": [ [ "restrictionType", "eq", "passwordAddition" ], [ "state", "eq", "disabled" ] ], "operator": "and", "whereObject":"applicationRestrictions.passwordCredentials" } ] }, { "connectOperator":"or", "filter": [ { "conditions": [ [ "restrictionType", "eq", "passwordAddition" ], [ "state", "eq", "disabled" ] ], "operator": "and", "whereObject":"servicePrincipalRestrictions.passwordCredentials" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "Id", "displayName": "displayName", "description": "description", "isEnabled": "isEnabled" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "id": "Id", "displayName": "displayName", "description": "description", "isEnabled": "isEnabled" }, "expandObject": null }, "status": { "keyName": [], "message": "Ensure password addition is blocked for applications", "defaultMessage": "Ensure password addition is blocked for applications" }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraDefaultAppManagementPolicy" }, "onlyStatus": false } }, "idSuffix": "eid_enterprise_apps_password_addition_disabled", "notes": [], "categories": [], "immutable_properties": [ "id", "displayName" ], "id": "entraid_applications_003" } |