cirsec Baselines
Esc
Microsoft 365 tenant · Applications, consent & AI agents

Limit the lifetime of application certificates

When it fails: Application certificates can be registered with a lifetime of several years. A certificate credential that stays valid for years gives an attacker who copied the private key long-lasting access as the application.

CB-M365-APPS-009mediumactivemanualprofile baseline

Description

The tenant-wide app management policy enforces a maximum lifetime of {{ app_cert_max_days }} days for asymmetric key credentials (certificates) added to applications and service principals.

Rationale

Certificates are the preferred application credential, but a private key exported from a server or a pipeline is as useful to an attacker as a secret. A short lifetime limits the window of use of a stolen key and makes rotation a routine operation rather than an emergency.

Impact

Certificates must be renewed at least every {{ app_cert_max_days }} days. Automate renewal (for example through Azure Key Vault) before enforcing. Certificates issued by public CAs with a longer validity cannot be uploaded until reissued.

Setting

LocationEntra admin center > Entra ID > Enterprise apps > Application policies > Restrict max certificate lifetime (Graph policies/defaultAppManagementPolicy, keyCredentials restriction asymmetricKeyLifetime)
DefaultNot configured
RecommendedOn, at most {{ app_cert_max_days }} days, applies to all applications

Parameters

ParameterBaselineHardenedBounds
app_cert_max_daysinteger, days. Maximum lifetime of a new application certificate.1801801 to 365

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to Entra ID > Enterprise apps > Application policies.
  3. Check that the certificate lifetime restriction is On, set to at most {{ app_cert_max_days }} days, and applies to All applications.
  4. Alternative with Graph (scope Policy.Read.All): GET https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy. Check that isEnabled is true and that keyCredentials for applications and service principals contains asymmetricKeyLifetime with state = enabled and maxLifetime of at most P{{ app_cert_max_days }}D.
  5. Fail if the restriction is missing, disabled or longer than {{ app_cert_max_days }} days.

Remediation

  1. Sign in to the Microsoft Entra admin center as a Security Administrator together with Application Administrator or Cloud Application Administrator.
  2. Browse to Entra ID > Enterprise apps > Application policies and open the certificate lifetime restriction.
  3. Set it to On, enter {{ app_cert_max_days }} days, set Applies to to All applications and select Save.
  4. Graph alternative (scope Policy.ReadWrite.ApplicationConfiguration): PATCH https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy adding {"restrictionType": "asymmetricKeyLifetime", "state": "enabled", "maxLifetime": "P{{ app_cert_max_days }}D"} to keyCredentials for applications and service principals, keeping existing restrictions.

Rollback

Set the certificate lifetime restriction to Off or raise the maximum lifetime.

References

Mappings

FrameworkIDRelationNote
NIST SP 800-53 Rev. 55.1.1IA-5(2)related
NIST SP 800-53 Rev. 55.1.1IA-9related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.AAD.5.7v1stricter180 days by default instead of 365.

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr