{
  "id": "CB-M365-APPS-008",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-008",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-008.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-APPS-008.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-APPS-008",
    "title": "Allow only system-generated client secrets",
    "finding": {
      "title": "Applications can use client secrets chosen by a person",
      "description": "Custom secrets can be short, reused or guessable, and are often set to a value already used elsewhere."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "applications",
      "workload-identities",
      "credentials",
      "client-secrets",
      "app-management-policy"
    ],
    "description": "The tenant-wide app management policy blocks custom password credentials\n(`customPasswordAddition`) on applications and service principals. When a secret is still\nallowed through an exception to CB-M365-APPS-006, Microsoft Entra generates its value.\n",
    "rationale": "Through Microsoft Graph, a client can supply its own secret value instead of letting Microsoft\nEntra generate a random one. Human-chosen values are weaker and tend to be reused across\napplications and environments, so one leak opens several doors.\n",
    "impact": "Scripts or products that set their own secret value through Graph (for example during automated\nprovisioning) fail and must read the generated value from the API response instead.\n",
    "notes": "Redundant while **Block password addition** (CB-M365-APPS-006) applies to all applications,\nbut it still protects applications that have an exception.\n",
    "setting": {
      "location": "Entra admin center > Entra ID > Enterprise apps > Application policies > Block custom passwords (Graph policies/defaultAppManagementPolicy, passwordCredentials restriction customPasswordAddition)",
      "default_value": "Not configured",
      "recommended_value": "On, applies to all applications"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Enterprise apps** > **Application policies**.\n3. Check that the custom password restriction is **On** for **All applications**.\n4. Alternative with Graph (scope `Policy.Read.All`):\n   `GET https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy`. Check that\n   `isEnabled` is `true` and that `passwordCredentials` for applications and service principals\n   contains `customPasswordAddition` with `state` = `enabled`.\n5. Also check custom policies assigned as exceptions\n   (`GET https://graph.microsoft.com/v1.0/policies/appManagementPolicies`): they must not\n   disable `customPasswordAddition`.\n6. Fail if the restriction is missing or disabled in the default policy or in an exception\n   policy.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as a Security Administrator together with\n   Application Administrator or Cloud Application Administrator.\n2. Browse to **Entra ID** > **Enterprise apps** > **Application policies** and open the custom\n   password restriction.\n3. Set it to **On**, **Applies to** = **All applications**, and select **Save**.\n4. Graph alternative (scope `Policy.ReadWrite.ApplicationConfiguration`):\n   `PATCH https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy` adding\n   `{\"restrictionType\": \"customPasswordAddition\", \"state\": \"enabled\"}` to `passwordCredentials`\n   for applications and service principals, keeping existing restrictions.\n",
      "rollback": "Set the custom password restriction to **Off**.\n"
    },
    "references": [
      {
        "title": "Configure restrictions on how applications can be configured",
        "url": "https://learn.microsoft.com/entra/identity/enterprise-apps/configure-app-management-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-APPS-006",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}