AZ_SECRET_ASSIGNED_TO

Summary

Forestall ACL Alias	AZ_SECRET_ASSIGNED_TO
Entra ID (Azure AD) Alias	Password Credential (client secret) on Application
Affected Object Types	App Secret -> Application
Edge Direction	AZAppSecret -> AZApplication
Exploitation Certainty	Informational

Description

AZ_SECRET_ASSIGNED_TO connects an application client secret (AZAppSecret, a password credential) to the App Registration (AZApplication) it belongs to. Each secret node is drawn from the application's passwordCredentials collection.

A client secret is a persistent shared secret: whoever knows the application's client id and secret value can request tokens and act as the application, and therefore as the service principal it runs as (see AZ_RUNS_AS). The edge is structural inventory of which secrets are attached to which application, which matters for credential hygiene: secrets that never expire, secrets far past their intended lifetime, or unexpected secrets on a privileged app are all findings.

Adding a new secret is the abuse primitive and is modelled by AZ_ADD_SECRET. This edge represents secrets that already exist on the app.

The node carries secret metadata such as DisplayName, KeyId, Hint, StartDateTime, and EndDateTime. The secret value itself is never retrievable after creation and is not stored.

Identification

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "Application.Read.All"

Get-MgApplication -All | ForEach-Object {
    foreach ($secret in $_.PasswordCredentials) {
        [PSCustomObject]@{
            AppName    = $_.DisplayName
            AppId      = $_.AppId
            SecretName = $secret.DisplayName
            KeyId      = $secret.KeyId
            NotBefore  = $secret.StartDateTime
            NotAfter   = $secret.EndDateTime
        }
    }
} | Format-Table -AutoSize

Azure Portal

1. Open Microsoft Entra admin center -> App registrations -> select the application.

2. Open Certificates & secrets -> Client secrets to review the secrets on the app and their expiry.

Exploitation

There is no direct exploit for this edge; it inventories an existing secret on an application. Acting as the application requires knowing the secret value, or adding a new one (AZ_ADD_SECRET), after which the attacker authenticates as the app and abuses the service principal it runs as (AZ_RUNS_AS).

Mitigation

• Inventory application secrets and remove unused, expired, or unexpected ones.

• Prefer certificate credentials over client secrets, and prefer managed identities where possible.

• Set and enforce short secret lifetimes; rotate regularly.

• Restrict who can add credentials to applications and monitor for new secret additions.

Detection

Use the Microsoft Entra admin center:

1. Open Microsoft Entra ID -> Audit logs.

2. Filter Activity for Update application - Certificates and secrets management.

3. Review Initiated by (actor), Target (the application), Date, and Status for unexpected secret additions.

References

• https://learn.microsoft.com/en-us/graph/api/resources/passwordcredential

• https://learn.microsoft.com/en-us/graph/api/application-addpassword

• https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals