cirsec Baselines
Esc
Microsoft 365 tenant · Applications, consent & AI agents

Limit the lifetime of application client secrets

When it fails: Application client secrets can be created with a long or unlimited lifetime. A secret that stays valid for years keeps working long after it leaked in a script, a repository or a former employee's notes.

CB-M365-APPS-007mediumactivemanualprofile baseline

Description

The tenant-wide app management policy enforces a maximum lifetime of {{ app_secret_max_days }} days for password credentials (client secrets) on applications and service principals. Secrets that already exist with a longer lifetime are tracked and replaced (CB-M365-APPS-010).

Rationale

Where secrets cannot be avoided yet (CB-M365-APPS-006 exceptions, or existing applications), a short lifetime limits how long a leaked secret can be used and forces regular rotation, which also keeps the list of people who know the secret current.

Impact

Teams that manage applications with secrets must rotate them at least every {{ app_secret_max_days }} days. Plan rotation reminders, for example with the Entra recommendation on expiring credentials.

Setting

LocationEntra admin center > Entra ID > Enterprise apps > Application policies > Restrict max password lifetime (Graph policies/defaultAppManagementPolicy, passwordCredentials restriction passwordLifetime)
DefaultNot configured
RecommendedOn, at most {{ app_secret_max_days }} days, applies to all applications

Parameters

ParameterBaselineHardenedBounds
app_secret_max_daysinteger, days. Maximum lifetime of a new client secret.1801801 to 180

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to Entra ID > Enterprise apps > Application policies.
  3. Check that the password lifetime restriction is On, set to at most {{ app_secret_max_days }} days, and applies to All applications.
  4. Alternative with Graph (scope Policy.Read.All): GET https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy. Check that isEnabled is true and that passwordCredentials in both applicationRestrictions and servicePrincipalRestrictions contains passwordLifetime with state = enabled and maxLifetime of at most P{{ app_secret_max_days }}D.
  5. Fail if the restriction is missing, disabled, longer than {{ app_secret_max_days }} days, or set for only one of the two object types.

Remediation

  1. Sign in to the Microsoft Entra admin center as a Security Administrator together with Application Administrator or Cloud Application Administrator.
  2. Browse to Entra ID > Enterprise apps > Application policies and open the password lifetime restriction.
  3. Set it to On, enter a maximum lifetime of {{ app_secret_max_days }} days, set Applies to to All applications and select Save.
  4. Graph alternative (scope Policy.ReadWrite.ApplicationConfiguration): PATCH https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy adding {"restrictionType": "passwordLifetime", "state": "enabled", "maxLifetime": "P{{ app_secret_max_days }}D"} to passwordCredentials for applications and service principals, keeping existing restrictions.

Rollback

Set the password lifetime restriction to Off or raise the maximum lifetime.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1IA-5related
NIST SP 800-53 Rev. 55.1.1IA-9related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.AAD.5.6v1equivalent

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1552.001

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr