Allow only system-generated client secrets

Description

The tenant-wide app management policy blocks custom password credentials (customPasswordAddition) on applications and service principals. When a secret is still allowed through an exception to CB-M365-APPS-006, Microsoft Entra generates its value.

Redundant while Block password addition (CB-M365-APPS-006) applies to all applications, but it still protects applications that have an exception.

Rationale

Through Microsoft Graph, a client can supply its own secret value instead of letting Microsoft Entra generate a random one. Human-chosen values are weaker and tend to be reused across applications and environments, so one leak opens several doors.

Impact

Scripts or products that set their own secret value through Graph (for example during automated provisioning) fail and must read the generated value from the API response instead.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Enterprise apps > Application policies.
3. Check that the custom password restriction is On for All applications.
4. Alternative with Graph (scope Policy.Read.All): GET https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy. Check that isEnabled is true and that passwordCredentials for applications and service principals contains customPasswordAddition with state = enabled.
5. Also check custom policies assigned as exceptions (GET https://graph.microsoft.com/v1.0/policies/appManagementPolicies): they must not disable customPasswordAddition.
6. Fail if the restriction is missing or disabled in the default policy or in an exception policy.

Remediation

1. Sign in to the Microsoft Entra admin center as a Security Administrator together with Application Administrator or Cloud Application Administrator.
2. Browse to Entra ID > Enterprise apps > Application policies and open the custom password restriction.
3. Set it to On, Applies to = All applications, and select Save.
4. Graph alternative (scope Policy.ReadWrite.ApplicationConfiguration): PATCH https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy adding {"restrictionType": "customPasswordAddition", "state": "enabled"} to passwordCredentials for applications and service principals, keeping existing restrictions.

Rollback

Set the custom password restriction to Off.

References

• Configure restrictions on how applications can be configured Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-APPS-006 Block new password credentials on applications

People and lifecycle