AZ_CERTIFICATE_ASSIGNED_TO

Copy page

Summary


Forestall ACL Alias	AZ_CERTIFICATE_ASSIGNED_TO
Entra ID (Azure AD) Alias	Key Credential (certificate) on Application
Affected Object Types	App Certificate -> Application
Edge Direction	AZAppCertificate -> AZApplication
Exploitation Certainty	Informational

Description

AZ_CERTIFICATE_ASSIGNED_TO connects an application certificate credential (AZAppCertificate, a key credential on the app) to the App Registration (AZApplication) it belongs to. Each certificate node is drawn from the application’s keyCredentials collection.

A certificate credential lets whoever holds the matching private key authenticate as the application, and therefore as the service principal the application runs as (see AZ_RUNS_AS). The edge itself is structural inventory.

Adding a new credential to an application is the abuse primitive, and that is modelled by AZ_ADD_SECRET. This edge represents credentials that already exist on the app.

The node carries certificate metadata such as DisplayName, KeyId, Type, Usage, StartDateTime, and EndDateTime.

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Application.Read.All"

Get-MgApplication -All | ForEach-Object {
    foreach ($cert in $_.KeyCredentials) {
        [PSCustomObject]@{
            AppName   = $_.DisplayName
            AppId     = $_.AppId
            CertName  = $cert.DisplayName
            KeyId     = $cert.KeyId
            Usage     = $cert.Usage
            NotBefore = $cert.StartDateTime
            NotAfter  = $cert.EndDateTime
        }
    }
} | Format-Table -AutoSize

Exploitation

There is no direct exploit for this edge; it inventories an existing certificate credential on an application. Impersonating the application requires the certificate’s private key, or the ability to add a new credential (AZ_ADD_SECRET), after which the attacker can authenticate as the app and abuse the service principal it runs as (AZ_RUNS_AS).

Mitigation

Inventory application certificates and remove unused, expired, or unexpected credentials.
Prefer short-lived certificates and rotate them regularly.
Restrict who can add credentials to applications (Owners and Application/Cloud Application Administrators).
Monitor for new credential additions on privileged applications.

Detection

Use the Microsoft Entra admin center:

Open Microsoft Entra ID -> Audit logs.
Filter Activity for Update application - Certificates and secrets management.
Review Initiated by (actor), Target (the application), Date, and Status for unexpected certificate changes.

Ask AI