> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_certificate_assigned_to.md).

# AZ\_CERTIFICATE\_ASSIGNED\_TO

## Summary

|                               |                                             |
| ----------------------------- | ------------------------------------------- |
| **Forestall ACL Alias**       | AZ\_CERTIFICATE\_ASSIGNED\_TO               |
| **Entra ID (Azure AD) Alias** | Key Credential (certificate) on Application |
| **Affected Object Types**     | App Certificate -> Application              |
| **Edge Direction**            | AZAppCertificate -> AZApplication           |
| **Exploitation Certainty**    | Informational                               |

## Description

`AZ_CERTIFICATE_ASSIGNED_TO` connects an application **certificate credential** (`AZAppCertificate`, a key credential on the app) to the **App Registration** (`AZApplication`) it belongs to. Each certificate node is drawn from the application's `keyCredentials` collection.

A certificate credential lets whoever holds the matching **private key** authenticate as the application, and therefore as the service principal the application runs as (see [AZ\_RUNS\_AS](https://docs.forestall.io/fsprotect/edges/azure/az_runs_as)). The edge itself is structural inventory.

Adding a **new** credential to an application is the abuse primitive, and that is modelled by [AZ\_ADD\_SECRET](https://docs.forestall.io/fsprotect/edges/azure/az_add_secret). This edge represents credentials that already exist on the app.

The node carries certificate metadata such as `DisplayName`, `KeyId`, `Type`, `Usage`, `StartDateTime`, and `EndDateTime`.

## Identification

### PowerShell (Microsoft Graph)

```powershell
Connect-MgGraph -Scopes "Application.Read.All"

Get-MgApplication -All | ForEach-Object {
    foreach ($cert in $_.KeyCredentials) {
        [PSCustomObject]@{
            AppName   = $_.DisplayName
            AppId     = $_.AppId
            CertName  = $cert.DisplayName
            KeyId     = $cert.KeyId
            Usage     = $cert.Usage
            NotBefore = $cert.StartDateTime
            NotAfter  = $cert.EndDateTime
        }
    }
} | Format-Table -AutoSize
```

### Azure Portal

1. Open **Microsoft Entra admin center** -> **App registrations** -> select the application.
2. Open **Certificates & secrets** -> **Certificates** to review the certificates on the app, including thumbprint and expiry.

## Exploitation

There is no direct exploit for this edge; it inventories an existing certificate credential on an application. Impersonating the application requires the certificate's private key, or the ability to add a new credential ([AZ\_ADD\_SECRET](https://docs.forestall.io/fsprotect/edges/azure/az_add_secret)), after which the attacker can authenticate as the app and abuse the service principal it runs as ([AZ\_RUNS\_AS](https://docs.forestall.io/fsprotect/edges/azure/az_runs_as)).

## Mitigation

* Inventory application certificates and remove unused, expired, or unexpected credentials.
* Prefer short-lived certificates and rotate them regularly.
* Restrict who can add credentials to applications (Owners and Application/Cloud Application Administrators).
* Monitor for new credential additions on privileged applications.

## Detection

Use the Microsoft Entra admin center:

1. Open **Microsoft Entra ID** -> **Audit logs**.
2. Filter **Activity** for **Update application - Certificates and secrets management**.
3. Review **Initiated by (actor)**, **Target** (the application), **Date**, and **Status** for unexpected certificate changes.

## References

* <https://learn.microsoft.com/en-us/graph/api/resources/keycredential>
* <https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals>
* <https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal>