App management policy enforces credential restrictions

​

What this check verifies

Microsoft Entra ID default app management policy is verified to have the required credential restrictions configured for applications: block password addition, restrict max password lifetime, block custom passwords, and restrict max certificate lifetime.

​

Risk

Without the required credential restrictions, applications and service principals can use insecure credential configurations, including long-lived secrets, custom passwords, or unrestricted certificates, increasing the risk of credential compromise and unauthorized access.

​

Recommendation

Configure the default app management policy with all required credential restrictions: block password addition, restrict max password lifetime, block custom passwords, and restrict max certificate lifetime. These restrictions prevent applications from using insecure or long-lived credentials.

​

Remediation

Dashboard steps

1. Navigate to the Microsoft Entra admin center (https://entra.microsoft.com/).
2. Go to Identity > Applications > App management policies.
3. Select the Default app management policy.
4. Under Password restrictions, enable: Block password addition, Restrict max password lifetime, and Block custom passwords.
5. Under Certificate restrictions, enable: Restrict max certificate lifetime.
6. Save the changes.

​

References

• https://learn.microsoft.com/en-us/graph/api/resources/tenantappmanagementpolicy
• https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/app-management-policies-overview

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_default_app_management_policy_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks