What this check looks at
Checks the default app management policy against CIS: client secrets blocked, secrets limited to 180 days and system-generated, certificates limited to 180 days, each on for apps and for service principals, in force from a date already passed.
Applications sign in to Microsoft 365 with credentials of their own: client secrets (a generated password) or certificates. The tenant’s default app management policy can restrict them for every app at once: block secrets altogether, cap how long secrets and certificates last, and stop people choosing a secret’s value themselves. Each restriction is set separately for applications and for service principals, and each can apply only to apps created after a given date.
This check applies CIS’s own test. It passes only when the policy is on and, for applications and for service principals alike, client secrets are blocked, secrets are limited to 180 days, custom secrets are blocked and certificates are limited to 180 days, each restriction enabled and in force from a date already passed. It names each restriction that is missing. It says it could not check when only a summary of the policy was read.
The admin centre shows only the combination of the two sides, so a tenant can look restricted there while service principals, which are what actually sign in, are not. A restriction that applies only to apps created after next month restricts nothing today.
Why it matters
Application secrets and certificates are passwords for software, often with wide access to mail and files. A long-lived one, or one chosen by a person, keeps working after whoever made it has left, and a stolen one works for as long. The app management policy is where the whole tenant is held to short, generated credentials.
A developer at a 60-person engineering firm creates a client secret valid for two years for a reporting app with read access to every mailbox, and pastes it into a script in a shared folder. A year later the folder is copied by a contractor whose laptop is then compromised. With secrets blocked and certificates capped at 180 days, that secret would never have existed, and any certificate would have expired long before.
CIS Microsoft 365 Foundations Benchmark v7.0.0 asks for all four restrictions (5.1.5.3 to 5.1.5.6), for applications and service principals. CISA SCuBA asks for less (MS.AAD.5.5 to 5.7: one year for certificates), which the separate secret and certificate checks apply. App management policies need Microsoft Entra Workload ID Premium.
How to fix it
Where: Entra admin centre → Enterprise apps → Security → Application policies
Before you start
- Needs Workload ID Premium. List the apps that use client secrets or long-lived certificates, and plan their move to certificates of 180 days or less before blocking secrets.
- Set the restrictions to apply from a date already passed, or to all apps, so existing apps are covered too; new apps only is not what CIS asks.
Step by step
- List the apps that use secrets. In the Microsoft Entra admin centre, go to Entra ID > App registrations > All applications and open each app’s Certificates & secrets page, or use the app credential report, to list the apps with client secrets and certificates longer than 180 days. Plan to move each to a certificate of 180 days or less.
- Turn on the application policies. Go to Entra ID > Enterprise apps > Security > Application policies (preview names vary). Turn on Block password addition, Restrict max password lifetime (180 days), Block custom passwords and Restrict max certificate lifetime (180 days).
- Apply them to existing apps. For each restriction, apply it to all applications rather than only those created after a date. If a later date is needed while apps are moved over, set it, and come back to bring it forward: until then the finding stays open.
- Check the service principal side. In Microsoft Graph Explorer, run a v1.0 GET on policies/defaultAppManagementPolicy and confirm isEnabled is true and that applicationRestrictions and servicePrincipalRestrictions both list passwordAddition, passwordLifetime (P180D or less), customPasswordAddition and asymmetricKeyLifetime (P180D or less), each with state enabled.
What users will notice
None for users. App owners can no longer add client secrets, or certificates valid for more than 180 days.
How to confirm it worked
Graph: GET policies/defaultAppManagementPolicy shows isEnabled true and, under both applicationRestrictions and servicePrincipalRestrictions, the four restrictions enabled within 180 days.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM) |
| DSPT | Standard 10: Accountable suppliers |
| NIS2 | Art. 21(2)(h) Cryptography and encryption |
| Microsoft Cloud Security Benchmark | IM-3 Manage application identities securely and automaticallyIM-8 Restrict the exposure of credentials and secrets |
| Zero Trust | Applications |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 8.6.3 Passwords for application and system accounts are protected |
| NIST SP 800-171 | 3.5.2 Authenticate users, processes and devices |
| CMMC Level 2 | IA.L2-3.5.2 Authentication |
| ISO 27001:2022 | A.5.17 Authentication informationA.8.24 Use of cryptography |
| CIS M365 | 5.1.5.3 Ensure password addition is blocked for applications5.1.5.4 Ensure password lifetime for applications does not exceed 180 days5.1.5.5 Ensure new application passwords are system-generated5.1.5.6 Ensure maximum certificate lifetime for applications does not exceed 180 days |
| CIS Controls v8.1 | 5.5 Establish and maintain an inventory of service accounts (IG2) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access managementSupply chain security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- App management policies (Microsoft Learn)