APP-05: Service Principal Credential Hygiene

APP-05 is a security control that service principals are the #1 attack vector for m365 supply chain compromises. long-lived credentials on service principals (like those used in solarwinds, midnight blizzard) bypass mfa entirely and provide persistent access. It requires that all service principal credentials expire within 90 days and no service principals have non-expiring secrets, federated credentials or managed identities are preferred.

Service principals are the #1 attack vector for M365 supply chain compromises. Long-lived credentials on service principals (like those used in SolarWinds, Midnight Blizzard) bypass MFA entirely and provide persistent access.

APP-05 requires manual implementation. Review and rotate service principal credentials. Migrate to federated credentials where possible.

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

APP-05 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.

APP-05 is rated critical because failure to implement this control significantly increases the risk of security incidents. Service principals are the #1 attack vector for M365 supply chain compromises. Long-lived credentials on service principals (like those used in SolarWinds, Midnight Blizzard) bypass MFA entirely and provide persistent access.