What this check looks at
Checks the tenant’s default app management policy limits application certificates to a lifetime of 365 days or less.
Certificates are the better credential for applications, but a certificate valid for many years is nearly as risky as a long-lived secret. The tenant’s default app management policy can cap the lifetime of certificates added to applications (the asymmetricKeyLifetime restriction). By default there is no cap, and self-signed certificates are often created to last five or ten years.
The check passes when application certificates are limited to 366 days or less, and fails when no maximum is set or the maximum is longer.
A certificate’s private key can be copied from the server or laptop where it was made, from a backup, or from a departing engineer’s profile. Whoever holds it can act as the application until the certificate expires; with a ten-year certificate, that can outlast the app’s owner, the MSP contract and anyone’s memory that the certificate exists.
Why it matters
A certificate valid for years keeps working long after the person who made it has left, and a stolen one is useful to an attacker for just as long. A one-year limit forces regular renewal and a known owner.
An engineer creates a certificate for a reporting script, valid for ten years, and leaves the .pfx file in their downloads folder. They leave, and the old laptop is sold without being wiped. Whoever recovers the file can read whatever the app is allowed to, for the rest of the decade. A one-year limit forces renewal, which means someone has to know the certificate exists and who owns it.
Annual renewal is a small, schedulable task, and it keeps an up-to-date record of application credentials, which is exactly what an investigation needs when something goes wrong.
The CISA SCuBA baseline (MS.AAD.5.7v1) asks for application certificates to be limited to 365 days or less, and the rule maps to NIST CSF 2.0 PR.AA-01. App management policies need a Microsoft Entra Workload ID Premium licence.
How to fix it
Where: Entra admin centre → Enterprise apps → Security → Application policies
Before you start
- Needs Workload ID Premium. Check which apps use certificates valid for more than a year and plan their renewal.
Step by step
- Find long-lived certificates. In Microsoft Graph PowerShell (Connect-MgGraph -Scopes Application.Read.All), run Get-MgApplication -All -Property DisplayName,KeyCredentials | ForEach-Object { foreach ($k in $_.KeyCredentials) { [pscustomobject]@{ App = $_.DisplayName; Expires = $k.EndDateTime } } } | Sort-Object Expires. Note certificates that expire more than a year from now, and plan to replace them with one-year certificates when they are next renewed.
- Read the current policy. Connect with Connect-MgGraph -Scopes Policy.ReadWrite.ApplicationConfiguration and run Get-MgPolicyDefaultAppManagementPolicy | ConvertTo-Json -Depth 5, so you keep any client secret restrictions already in place.
- Set the certificate lifetime limit. Run Update-MgPolicyDefaultAppManagementPolicy -BodyParameter with isEnabled set to true and an applicationRestrictions.keyCredentials entry of restrictionType asymmetricKeyLifetime, maxLifetime P365D and restrictForAppsCreatedAfterDateTime set to a past date. Include the existing passwordCredentials restrictions in the same body, because each list is replaced as a whole. Where the admin centre shows Application policies under Enterprise apps, the same setting is there.
- Tell the people who manage apps. Tell developers and the MSP team that new application certificates can be valid for at most a year, and put renewal dates in the client’s calendar or ticketing system.
- Confirm. Run Get-MgPolicyDefaultAppManagementPolicy again and check isEnabled is True and the certificate restriction shows P365D. Uploading a certificate valid for more than a year to a test app should be refused. Re-run the assessment to confirm.
What users will notice
None for users. New application certificates cannot be valid for more than a year.
How to confirm it worked
Entra admin centre, Enterprise apps, Security, Application policies: the maximum certificate lifetime is 365 days or less.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM) |
| DSPT | Standard 10: Accountable suppliers |
| NIS2 | Art. 21(2)(h) Cryptography and encryption |
| Microsoft Cloud Security Benchmark | IM-3 Manage application identities securely and automaticallyIM-8 Restrict the exposure of credentials and secrets |
| Zero Trust | Applications |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 8.6.3 Passwords for application and system accounts are protected |
| NIST SP 800-171 | 3.5.2 Authenticate users, processes and devices |
| CMMC Level 2 | IA.L2-3.5.2 Authentication |
| ISO 27001:2022 | A.5.17 Authentication informationA.8.24 Use of cryptography |
| CISA SCuBA | MS.AAD.5.7v1 Application certificate lifetime of 365 days or less |
| CIS Controls v8.1 | 5.5 Establish and maintain an inventory of service accounts (IG2) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access managementSupply chain security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- App management policies (Microsoft Learn)