{
  "id": "CB-M365-APPS-006",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-006",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-006.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-006.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-APPS-006",
    "title": "Block new password credentials on applications",
    "finding": {
      "title": "New client secrets can be added to applications and service principals",
      "description": "Anyone who can manage an application, including an attacker who took over an owner account, can add a client secret and authenticate as the application from anywhere."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "applications",
      "workload-identities",
      "credentials",
      "client-secrets",
      "app-management-policy"
    ],
    "description": "The tenant-wide app management policy is enabled and blocks the addition of new password\ncredentials (client secrets) and symmetric keys on both application objects and service\nprincipals. Applications authenticate with certificates, federated identity credentials or\nmanaged identities instead. Exceptions go through a custom app management policy assigned to\nthe specific application, with a documented reason.\n",
    "rationale": "A client secret is a shared password: it is copied into configuration files, scripts and\npipelines, cannot be bound to a device and is the credential most often found in leaks. Adding a\nsecret to an existing privileged application is also a classic persistence technique after an\nadministrator account is compromised. Blocking new secrets closes this path while leaving\nexisting secrets working until they are migrated (CB-M365-APPS-010).\n",
    "impact": "Developers and integrators can no longer create client secrets. Third-party products that only\nsupport secrets need an exception policy. Existing secrets keep working until they expire.\n",
    "notes": "The restriction can target only applications created after a given date\n(`restrictForAppsCreatedAfterDateTime`); set a date in the past so that it covers all\napplications. Check the licensing shown in the admin center for app management policies in your\ntenant.\n",
    "setting": {
      "location": "Entra admin center > Entra ID > Enterprise apps > Application policies > Block password addition (Graph policies/defaultAppManagementPolicy, passwordCredentials restriction passwordAddition)",
      "default_value": "Off",
      "recommended_value": "On, applies to all applications"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Enterprise apps** > **Application policies**.\n3. Check that **Block password addition** is **On** and **Applies to** is **All applications**\n   (or **All applications with exclusions** with a short, documented exclusion list).\n4. Alternative with Graph (scope `Policy.Read.All`):\n   `GET https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy`. Check that\n   `isEnabled` is `true` and that `applicationRestrictions.passwordCredentials` and\n   `servicePrincipalRestrictions.passwordCredentials` both contain `passwordAddition` and\n   `symmetricKeyAddition` with `state` = `enabled`.\n5. List exceptions with `GET https://graph.microsoft.com/v1.0/policies/appManagementPolicies`.\n6. Fail if the policy is disabled, if either restriction is missing or disabled for applications\n   or service principals, or if an exception has no documented owner and reason.\n"
    },
    "remediation": {
      "manual": "1. Inventory the applications that still create new secrets (audit log activity **Update\n   application – Certificates and secrets management**) and plan certificates, federated\n   credentials or managed identities for them.\n2. Sign in to the Microsoft Entra admin center as a Security Administrator together with\n   Application Administrator or Cloud Application Administrator.\n3. Browse to **Entra ID** > **Enterprise apps** > **Application policies** and select **Block\n   password addition**.\n4. Set the status to **On**, set **Applies to** to **All applications** and select **Save**.\n5. Graph alternative (scope `Policy.ReadWrite.ApplicationConfiguration`):\n   `PATCH https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy` with\n   `isEnabled: true` and the `passwordAddition` and `symmetricKeyAddition` restrictions in both\n   `applicationRestrictions` and `servicePrincipalRestrictions`, keeping the restrictions that\n   already exist.\n6. For a justified exception, create a custom app management policy that disables the\n   restriction and assign it to that application only.\n",
      "rollback": "Set **Block password addition** to **Off**, or exclude the affected application.\n"
    },
    "references": [
      {
        "title": "Configure restrictions on how applications can be configured",
        "url": "https://learn.microsoft.com/entra/identity/enterprise-apps/configure-app-management-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "tenantAppManagementPolicy resource type",
        "url": "https://learn.microsoft.com/graph/api/resources/tenantappmanagementpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Baseline security mode settings",
        "url": "https://learn.microsoft.com/microsoft-365/baseline-security-mode/baseline-security-mode-settings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.5.5v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-9",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1098.001"
      },
      {
        "framework": "mitre-attack",
        "id": "T1552.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-APPS-007",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-008",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-010",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}