> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_secret_assigned_to.md).

# AZ\_SECRET\_ASSIGNED\_TO

## Summary

|                               |                                                    |
| ----------------------------- | -------------------------------------------------- |
| **Forestall ACL Alias**       | AZ\_SECRET\_ASSIGNED\_TO                           |
| **Entra ID (Azure AD) Alias** | Password Credential (client secret) on Application |
| **Affected Object Types**     | App Secret -> Application                          |
| **Edge Direction**            | AZAppSecret -> AZApplication                       |
| **Exploitation Certainty**    | Informational                                      |

## Description

`AZ_SECRET_ASSIGNED_TO` connects an application **client secret** (`AZAppSecret`, a password credential) to the **App Registration** (`AZApplication`) it belongs to. Each secret node is drawn from the application's `passwordCredentials` collection.

A client secret is a persistent shared secret: whoever knows the application's client id and secret value can request tokens and act as the application, and therefore as the service principal it runs as (see [AZ\_RUNS\_AS](https://docs.forestall.io/fsprotect/edges/azure/az_runs_as)). The edge is structural inventory of which secrets are attached to which application, which matters for credential hygiene: secrets that never expire, secrets far past their intended lifetime, or unexpected secrets on a privileged app are all findings.

Adding a **new** secret is the abuse primitive and is modelled by [AZ\_ADD\_SECRET](https://docs.forestall.io/fsprotect/edges/azure/az_add_secret). This edge represents secrets that already exist on the app.

The node carries secret metadata such as `DisplayName`, `KeyId`, `Hint`, `StartDateTime`, and `EndDateTime`. The secret value itself is never retrievable after creation and is not stored.

## Identification

### PowerShell (Microsoft Graph)

```powershell
Connect-MgGraph -Scopes "Application.Read.All"

Get-MgApplication -All | ForEach-Object {
    foreach ($secret in $_.PasswordCredentials) {
        [PSCustomObject]@{
            AppName    = $_.DisplayName
            AppId      = $_.AppId
            SecretName = $secret.DisplayName
            KeyId      = $secret.KeyId
            NotBefore  = $secret.StartDateTime
            NotAfter   = $secret.EndDateTime
        }
    }
} | Format-Table -AutoSize
```

### Azure Portal

1. Open **Microsoft Entra admin center** -> **App registrations** -> select the application.
2. Open **Certificates & secrets** -> **Client secrets** to review the secrets on the app and their expiry.

## Exploitation

There is no direct exploit for this edge; it inventories an existing secret on an application. Acting as the application requires knowing the secret value, or adding a new one ([AZ\_ADD\_SECRET](https://docs.forestall.io/fsprotect/edges/azure/az_add_secret)), after which the attacker authenticates as the app and abuses the service principal it runs as ([AZ\_RUNS\_AS](https://docs.forestall.io/fsprotect/edges/azure/az_runs_as)).

## Mitigation

* Inventory application secrets and remove unused, expired, or unexpected ones.
* Prefer certificate credentials over client secrets, and prefer managed identities where possible.
* Set and enforce short secret lifetimes; rotate regularly.
* Restrict who can add credentials to applications and monitor for new secret additions.

## Detection

Use the Microsoft Entra admin center:

1. Open **Microsoft Entra ID** -> **Audit logs**.
2. Filter **Activity** for **Update application - Certificates and secrets management**.
3. Review **Initiated by (actor)**, **Target** (the application), **Date**, and **Status** for unexpected secret additions.

## References

* <https://learn.microsoft.com/en-us/graph/api/resources/passwordcredential>
* <https://learn.microsoft.com/en-us/graph/api/application-addpassword>
* <https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals>