rules/findings/old/entraid/Applications/CIS3.1/eid-new-application-passwords-not-autogenerated.json
|
{
"provider": "EntraID", "serviceType": "Applications", "serviceName": "Microsoft Entra ID", "displayName": "Ensure new application passwords are system-generated", "description": "In Microsoft Entra ID, applications and service principals can authenticate using password credentials (also referred to as client secrets). By default, when adding a new password credential, the caller may supply a custom password value or allow the system to generate one. This setting enforces a tenant-wide restriction that blocks the use of custom password values, requiring all new password credentials to be systemgenerated. The policy is implemented through the default app management policy and applies to all applications unless scoped exceptions are configured.\r\nThe setting does not affect existing password credentials; credentials created before the policy was enabled remain valid until they expire or are explicitly removed.\r\nThe recommended state is **Block custom passwords** set to **On**. ", "rationale": "Custom password values are chosen by the caller and are susceptible to low entropy, predictable patterns, and reuse across multiple applications. A weak or reused client secret that is compromised through source code exposure, logging, or a supply-chain breach can be trivially exploited by an attacker to authenticate as the application. System-generated passwords use random values of sufficient length and complexity, making them resistant to brute-force and dictionary attacks. Blocking custom passwords removes the weakest credential creation path and ensures that all new client secrets meet a consistent entropy baseline.", "impact": "Any automated process, pipeline, or script that programmatically creates a client secret by supplying a custom password value will be blocked once the policy is enabled, unless an exception is configured. Most tooling, including the Microsoft Entra admin center, Azure CLI, and Azure PowerShell, already defaults to system-generated values, so the operational impact for typical workflows is minimal. Organizations that rely on custom password values in their automation will need to update those workflows to omit the custom value and accept the system-generated secret.\r\nOrganizations that have policies or regulatory requirements that mandate specific password formats may need to maintain exclusions for certain applications. Exceptions should be scoped narrowly and reviewed regularly to minimize risk.", "remediation": { "text": " #### Remediate from Entra ID 1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/ 2. Expand Entra ID and select Enterprise apps 3. Under Security select Application policies. 4. Select Block custom passwords. 5. Set Status to On. 6. Set the maximum lifetime to 180 days or less. 7. Set Applies to to one of the following: * All applications * All applications with exclusions (if using exclusions, ensure they are reviewed annually). 8. Set Only apply to apps created after to a desired date or leave it unconfigured. 9. Select Save and close to apply the changes. ", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies?tabs=portal", "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-enforce-secret-standards?pivots=ms-graph", "https://learn.microsoft.com/en-us/graph/api/resources/tenantappmanagementpolicy?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/entra/fundamentals/zero-trust-protect-identities#enforce-standards-for-app-secrets-and-certificates" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "7.0.0", "reference": "5.1.5.5", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "aad_default_app_management_policy", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "applicationRestrictions.passwordCredentials.Count", "eq", 0 ], [ "servicePrincipalRestrictions.passwordCredentials.Count", "eq", 0 ] ], "operator": "or" } ] }, { "connectOperator":"or", "filter": [ { "conditions": [ [ "restrictionType", "eq", "customPasswordAddition" ], [ "state", "eq", "disabled" ] ], "operator": "and", "whereObject":"applicationRestrictions.passwordCredentials" } ] }, { "connectOperator":"or", "filter": [ { "conditions": [ [ "restrictionType", "eq", "customPasswordAddition" ], [ "state", "eq", "disabled" ] ], "operator": "and", "whereObject":"servicePrincipalRestrictions.passwordCredentials" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "Id", "displayName": "displayName", "description": "description", "isEnabled": "isEnabled" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "id": "Id", "displayName": "displayName", "description": "description", "isEnabled": "isEnabled" }, "expandObject": null }, "status": { "keyName": [], "message": "Ensure new application passwords are system-generated", "defaultMessage": "Ensure new application passwords are system-generated" }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraDefaultAppManagementPolicy" }, "onlyStatus": false } }, "idSuffix": "eid_enterprise_apps_custom_password_addition_disabled", "notes": [], "categories": [], "immutable_properties": [ "id", "displayName" ], "id": "entraid_applications_005" } |