The hidden blast radius of non-human identity credentials in multi-tenant clouds
Non-human identity credentials in multi-tenant clouds can bypass MFA and Conditional Access, posing a significant security risk. Auditing high-privilege app registrations and Microsoft Graph API permissions is crucial to mitigate this risk.
Introduction to Non-Human Identity Credentials
Non-human identity credentials, such as client secrets and service principals, are used to authenticate and authorize applications in multi-tenant clouds.
These credentials can pose a significant security risk if not properly managed, as they can bypass MFA and Conditional Access, allowing unauthorized access to sensitive resources.
Evidence: Application and service principal objects in Microsoft Entra ID, Zero Trust Architecture
Understanding Application Objects and Service Principals
In Microsoft Entra ID, an application object is created when an application is registered, and a service principal object is created in each tenant where the application is used.
The service principal object defines the permissions and access policy for the application in the tenant, and is used to authenticate and authorize the application.
Evidence: Application and service principal objects in Microsoft Entra ID, Zero Trust Architecture
Auditing High-Privilege App Registrations
Auditing high-privilege app registrations is crucial to identify potential security risks, such as over-privileged service principals or misconfigured application objects.
IT managers and IAM engineers can use the Microsoft Entra admin center to list and manage application objects and service principals, and to identify potential security risks.
Evidence: Application and service principal objects in Microsoft Entra ID, Zero Trust Architecture
Microsoft Graph API Permissions
Microsoft Graph API permissions are used to control access to Microsoft Entra ID resources, such as user and group data.
Auditing Microsoft Graph API permissions is essential to ensure that applications only have the necessary permissions to perform their intended functions, and to prevent unauthorized access to sensitive resources.
Evidence: Application and service principal objects in Microsoft Entra ID, Zero Trust Architecture
Zero Trust Architecture
Zero Trust Architecture (ZTA) is a security paradigm that assumes that all users and devices are untrusted, and verifies their identity and permissions before granting access to resources.
Implementing ZTA can help to mitigate the security risks associated with non-human identity credentials, by verifying the identity and permissions of applications and services before granting access to sensitive resources.
Evidence: Zero Trust Architecture
Best Practices for Securing Non-Human Identity Credentials
To secure non-human identity credentials, IT managers and IAM engineers should implement robust secrets management and rotation practices, and monitor CI/CD pipelines for suspicious activity.
Additionally, they should implement workload identity solutions that can issue credentials at runtime, validating access based on workload identity and preventing credential reuse.
Evidence: Application and service principal objects in Microsoft Entra ID, Zero Trust Architecture
Sources and further reading
Source links support the documented product behaviour. Recommendations and labelled examples are editorial guidance.