Block new password credentials on applications

Description

The tenant-wide app management policy is enabled and blocks the addition of new password credentials (client secrets) and symmetric keys on both application objects and service principals. Applications authenticate with certificates, federated identity credentials or managed identities instead. Exceptions go through a custom app management policy assigned to the specific application, with a documented reason.

The restriction can target only applications created after a given date (restrictForAppsCreatedAfterDateTime); set a date in the past so that it covers all applications. Check the licensing shown in the admin center for app management policies in your tenant.

Rationale

A client secret is a shared password: it is copied into configuration files, scripts and pipelines, cannot be bound to a device and is the credential most often found in leaks. Adding a secret to an existing privileged application is also a classic persistence technique after an administrator account is compromised. Blocking new secrets closes this path while leaving existing secrets working until they are migrated (CB-M365-APPS-010).

Impact

Developers and integrators can no longer create client secrets. Third-party products that only support secrets need an exception policy. Existing secrets keep working until they expire.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Enterprise apps > Application policies.
3. Check that Block password addition is On and Applies to is All applications (or All applications with exclusions with a short, documented exclusion list).
4. Alternative with Graph (scope Policy.Read.All): GET https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy. Check that isEnabled is true and that applicationRestrictions.passwordCredentials and servicePrincipalRestrictions.passwordCredentials both contain passwordAddition and symmetricKeyAddition with state = enabled.
5. List exceptions with GET https://graph.microsoft.com/v1.0/policies/appManagementPolicies.
6. Fail if the policy is disabled, if either restriction is missing or disabled for applications or service principals, or if an exception has no documented owner and reason.

Remediation

1. Inventory the applications that still create new secrets (audit log activity Update application – Certificates and secrets management) and plan certificates, federated credentials or managed identities for them.
2. Sign in to the Microsoft Entra admin center as a Security Administrator together with Application Administrator or Cloud Application Administrator.
3. Browse to Entra ID > Enterprise apps > Application policies and select Block password addition.
4. Set the status to On, set Applies to to All applications and select Save.
5. Graph alternative (scope Policy.ReadWrite.ApplicationConfiguration): PATCH https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy with isEnabled: true and the passwordAddition and symmetricKeyAddition restrictions in both applicationRestrictions and servicePrincipalRestrictions, keeping the restrictions that already exist.
6. For a justified exception, create a custom app management policy that disables the restriction and assign it to that application only.

Rollback

Set Block password addition to Off, or exclude the affected application.

References

• Configure restrictions on how applications can be configured Microsoft, vendor-doc, accessed 2026-10-24
• tenantAppManagementPolicy resource type Microsoft, vendor-doc, accessed 2026-10-24
• Baseline security mode settings Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-APPS-007 Limit the lifetime of application client secrets
• related CB-M365-APPS-008 Allow only system-generated client secrets
• related CB-M365-APPS-010 Clean up and rotate existing application credentials

People and lifecycle