EIDAPP-008: Credential Expiration Monitoring
- Plataforma
- Entra ID / M365
- Categoría
- Consent
- Severidad
- Medium
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Application credentials (client secrets and certificates) that are approaching expiration or have already expired can cause service outages if not rotated in time, or create security risks if expiration policies are set too far in the future. Credentials with long validity periods extend the window during which a compromised credential can be exploited. Proactive monitoring and alerting on credential expiration ensures timely rotation and reduces security exposure.
Valor recomendado
All application credentials have a maximum validity of 12 months with automated alerts at 30 and 60 days before expiration
Remediación
Enumerate all application credentials and their expiration dates using the Microsoft Graph API. Identify credentials expiring within 30 days and those with validity periods exceeding 12 months. Establish an automated monitoring process that alerts application owners and security teams when credentials approach expiration, and enforce a maximum credential lifetime policy through governance procedures.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.AAD.5.6v1, MS.AAD.5.7v1
- NIST SP 800-53
- IA-5(1)