EIDAPP-005: Service Principals with High Privileges and Added Credentials
- Platform
- Entra ID / M365
- Category
- Consent
- Severity
- Critical
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Service principals that combine high-privilege API permissions or directory role assignments with added client credentials represent the highest-risk application objects in the tenant. An attacker who obtains these credentials can authenticate non-interactively with elevated permissions, bypassing MFA and Conditional Access controls entirely. This combination of privilege and credential access is a primary persistence and lateral movement technique in cloud-based attacks.
Recommended value
No service principals with both high-privilege permissions and added credentials unless documented with mandatory compensating controls
Remediation
Cross-reference service principals that hold high-privilege API permissions or directory role assignments against those with added key or password credentials. For each match, validate the business necessity and either remove excessive permissions or migrate to managed identity authentication that eliminates the need for stored credentials. Implement certificate-based authentication with short-lived certificates where managed identities are not feasible.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6, IA-5
- MITRE ATT&CK
- T1098.001