Skip to content
Forestall

AZ_MG_ADD_SECRET

Copy page

Summary
Forestall ACL Alias AZ_MG_ADD_SECRET
Entra ID (Azure AD) Alias Add Secrets (Microsoft Graph)
Affected Object Types App registrations & Service Principals
Exploitation Certainty Certain
Graph Permission / Role Ability to add password credentials via Microsoft Graph using application permission Application.ReadWrite.All and/or directory roles such as Application Administrator, Cloud Application Administrator, Global Administrator or explicit Owner on the Application / Service Principal

Description

AZ_MG_ADD_SECRET represents the ability for a principal to add a new client secret / password credential via Microsoft Graph to an App Registration (application) or a Service Principal.

Adding a secret gives an attacker or a controlled identity the ability to:

  • Exchange the application’s client id + secret for tokens and act as that application, using any privileges granted to the app (delegated or application permissions).
  • If the application has broad application permissions, the attacker can perform tenant-wide actions or escalate further.
  • If the service principal represents infrastructure, cloud resources, or privileged automation, the new secret may be used to access production systems or pivot laterally.

Because secrets are persistent credentials that can be used from anywhere, the ability to add secrets is highly sensitive.

Identification

PowerShell (Microsoft Graph)

Enumerate service principals that have Microsoft Graph application permissions capable of adding secrets.

Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All"


# Get Microsoft Graph service principal and target app role IDs
$graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'" -Property Id,AppRoles
$targetPerms = @("Application.ReadWrite.All")
$targetRoleIds = $graphSp.AppRoles | Where-Object { $_.Value -in $targetPerms } | Select-Object -ExpandProperty Id


# Query app role assignments directly from Microsoft Graph SP
$assignments = Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graphSp.Id -All


# Filter for target permissions and build results
$results = $assignments | Where-Object { $_.AppRoleId -in $targetRoleIds } | ForEach-Object {
    $appRoleId = $_.AppRoleId
    [PSCustomObject]@{
        ServicePrincipalName = $_.PrincipalDisplayName
        ServicePrincipalId   = $_.PrincipalId
        Permission           = ($graphSp.AppRoles | Where-Object { $_.Id -eq $appRoleId }).Value
    }
}


$results | Format-Table -AutoSize

Exploitation

An attacker with Application.ReadWrite.All permission or ownership of an application can add a client secret and then authenticate as that application to abuse its permissions.

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Application.ReadWrite.All"


$appName    = "Example App"
$secretName = "AddedSecret"
$validDays  = 180


$app = Get-MgApplication -Filter "displayName eq '$appName'" | Select-Object -First 1


$passwordCred = @{
    displayName = $secretName
    endDateTime = (Get-Date).ToUniversalTime().AddDays($validDays)
}


$resp = Add-MgApplicationPassword -ApplicationId $app.Id -PasswordCredential $passwordCred


[PSCustomObject]@{
    ApplicationName = $app.DisplayName
    AppId           = $app.AppId
    SecretText      = $resp.SecretText
    ExpiresUtc      = $resp.EndDateTime
} | Format-List

Azure Portal

  • Go to Microsoft Entra admin center -> App registrations (or Enterprise applications).
  • Open the target object.
  • Go to Certificates & secrets.
  • Under Client secrets, create a new secret.
  • Copy the secret immediately and store it securely.

Mitigation

  • Minimize owners on applications and service principals.
  • Remove unnecessary Graph permissions from service principals:
    • Review and remove Application.ReadWrite.All when not required.
    • Prefer least-privilege patterns and narrow ownership boundaries.
  • Configure Application management policies to restrict credential operations:
    • Restrict or block password credential additions where possible.
    • Enforce maximum secret lifetimes.
    • Control exceptions with explicit scoping and approvals.
  • Use privileged access controls for admin roles (PIM where available).
  • Require change management for credential changes on production identities.
  • Regular access reviews:
    • Go to Identity Governance -> Access Reviews.
    • Review application owners and service principals with privileged permissions.

Detection

Use the Microsoft Entra admin center:

  1. Open Microsoft Entra ID -> Audit logs.
  2. Filter Category for ApplicationManagement.
  3. Filter Activity for Update application - Certificates and secrets management and Add service principal credentials.
  4. Review Initiated by (actor), Target resources, Date, Status, and modified credential properties for unexpected secret additions.
  5. Open the affected app registration or enterprise application and review Certificates & secrets, API permissions, and Owners.

References

Was this page helpful?

Thank you for your feedback.