APP-02: Enforce Application Credential Expiration

APP-02 is a security control that long-lived or non-expiring secrets are a supply chain attack risk. if a secret is leaked, it remains valid indefinitely. rotating credentials limits the window of exposure from compromised secrets. It requires that all application secrets (client secrets) have expiration dates and maximum secret lifetime is 12 months or less, certificate-based authentication is preferred over secrets, no non-expiring secrets exist.

Long-lived or non-expiring secrets are a supply chain attack risk. If a secret is leaked, it remains valid indefinitely. Rotating credentials limits the window of exposure from compromised secrets.

APP-02 requires manual implementation. Review and update application credentials

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

APP-02 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.

APP-02 is rated critical because failure to implement this control significantly increases the risk of security incidents. Long-lived or non-expiring secrets are a supply chain attack risk. If a secret is leaked, it remains valid indefinitely. Rotating credentials limits the window of exposure from compromised secrets.