AZ_CERTIFICATE_ASSIGNED_TO

Summary

Forestall ACL Alias	AZ_CERTIFICATE_ASSIGNED_TO
Entra ID (Azure AD) Alias	Key Credential (certificate) on Application
Affected Object Types	App Certificate -> Application
Edge Direction	AZAppCertificate -> AZApplication
Exploitation Certainty	Informational

Description

AZ_CERTIFICATE_ASSIGNED_TO connects an application certificate credential (AZAppCertificate, a key credential on the app) to the App Registration (AZApplication) it belongs to. Each certificate node is drawn from the application's keyCredentials collection.

A certificate credential lets whoever holds the matching private key authenticate as the application, and therefore as the service principal the application runs as (see AZ_RUNS_AS). The edge itself is structural inventory.

Adding a new credential to an application is the abuse primitive, and that is modelled by AZ_ADD_SECRET. This edge represents credentials that already exist on the app.

The node carries certificate metadata such as DisplayName, KeyId, Type, Usage, StartDateTime, and EndDateTime.

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Application.Read.All"

Get-MgApplication -All | ForEach-Object {
    foreach ($cert in $_.KeyCredentials) {
        [PSCustomObject]@{
            AppName   = $_.DisplayName
            AppId     = $_.AppId
            CertName  = $cert.DisplayName
            KeyId     = $cert.KeyId
            Usage     = $cert.Usage
            NotBefore = $cert.StartDateTime
            NotAfter  = $cert.EndDateTime
        }
    }
} | Format-Table -AutoSize

Azure Portal

1. Open Microsoft Entra admin center -> App registrations -> select the application.

2. Open Certificates & secrets -> Certificates to review the certificates on the app, including thumbprint and expiry.

Exploitation

There is no direct exploit for this edge; it inventories an existing certificate credential on an application. Impersonating the application requires the certificate's private key, or the ability to add a new credential (AZ_ADD_SECRET), after which the attacker can authenticate as the app and abuse the service principal it runs as (AZ_RUNS_AS).

Mitigation

• Inventory application certificates and remove unused, expired, or unexpected credentials.

• Prefer short-lived certificates and rotate them regularly.

• Restrict who can add credentials to applications (Owners and Application/Cloud Application Administrators).

• Monitor for new credential additions on privileged applications.

Detection

Use the Microsoft Entra admin center:

1. Open Microsoft Entra ID -> Audit logs.

2. Filter Activity for Update application - Certificates and secrets management.

3. Review Initiated by (actor), Target (the application), Date, and Status for unexpected certificate changes.

References

• https://learn.microsoft.com/en-us/graph/api/resources/keycredential

• https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals

• https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal