The Credential Sprawl Problem

Open your Azure portal, navigate to Microsoft Entra ID, and look at your App Registrations. How many are there? Fifty? Two hundred? A thousand?

Now the harder question: for each one, do you know who created it, what it’s used for, whether its credentials have expired, and what would break if you deleted it?

For most organizations, the honest answer is no. App Registration credentials are one of the most under-managed aspects of Azure security. They’re easy to create, rarely documented, and almost never cleaned up. The result is credential sprawl: a growing collection of secrets and certificates spread across your tenant, with unclear ownership and inconsistent lifecycle management.

Why App Registrations Are Different

Key Vault secrets are at least centralized by design. You know which vaults exist, you can list their contents, and you can set access policies. App Registration credentials are different in several important ways:

They live in Entra ID, not Key Vault. This means they’re managed through Microsoft Graph, not the Key Vault data plane. Different APIs, different RBAC model, different monitoring tools.

Anyone with the right role can create them. Application Developers, Cloud Application Administrators, and Application Administrators can all add credentials to App Registrations. In many tenants, these roles are broadly assigned.

They’re created through multiple channels. Azure Portal, Azure CLI, PowerShell, Terraform, ARM templates, and Microsoft Graph directly. There’s no single audit trail for credential creation across all channels.

They have no built-in lifecycle management. Key Vault has rotation events, expiry notifications, and soft-delete protection. App Registration credentials have an expiry date field. That’s it. No notifications, no automatic rotation, no cleanup.

The Anatomy of a Credential Leak

Here’s a pattern we see repeatedly:

  1. A developer creates an App Registration for a microservice integration
  2. They generate a client secret with a 2-year expiry (the default maximum in some configurations)
  3. The secret is stored in a Key Vault and referenced by an App Service
  4. Six months later, the developer leaves the organization
  5. Eighteen months later, the secret expires
  6. The App Service starts failing authentication to downstream APIs
  7. The on-call team scrambles to figure out which App Registration is affected, what it does, and how to create a new secret without breaking other consumers of the same App Registration

This scenario plays out constantly. The mean time to resolution is often measured in hours, not because the fix is complex, but because nobody knows the dependency graph.

Mapping the Dependency Graph

The first step toward controlling credential sprawl is understanding what depends on what. For each App Registration, you need to know:

  • What APIs does it access? Check the API Permissions blade to see delegated and application permissions
  • Where are its credentials stored? Check Key Vaults across all subscriptions for secrets that correspond to this App Registration’s client ID
  • What applications consume it? Check App Service and Function App configurations for Key Vault references or direct credential references
  • Who owns it? Check the Owners property in Entra ID, though this is often empty or outdated

Building this map manually is possible but painful. Microsoft Graph provides the raw data:

# List all App Registrations with credential details
az ad app list --all --query "[].{
    appId: appId,
    displayName: displayName,
    secretCount: length(passwordCredentials),
    certCount: length(keyCredentials),
    secrets: passwordCredentials[].{
        hint: hint,
        start: startDateTime,
        end: endDateTime
    },
    owners: owners
}" -o json

For a large tenant, this returns a wall of JSON. You need tooling to make it actionable.

Lifecycle Management Strategies

Strategy 1: Enforce Short-Lived Credentials

Microsoft now allows you to configure credential policies that limit maximum credential lifetime. This is a strong preventive control:

  • Set maximum client secret lifetime to 180 days (or less)
  • Require certificate-based credentials for production applications (certificates are generally more secure than client secrets)
  • Use Managed Identities wherever possible to eliminate credentials entirely

Managed Identities are the ideal solution when the consuming application runs in Azure. They eliminate credential management altogether. No secrets to rotate, no certificates to renew, no risk of credential exposure. Use them for App Services, Functions, Container Apps, VMs, and any other Azure compute that supports them.

Strategy 2: Centralize Credential Storage

Even when App Registrations are the identity provider, their credentials should be stored in Key Vault:

  1. Create the client secret on the App Registration
  2. Immediately store it in a designated Key Vault
  3. Configure consuming applications to reference the Key Vault secret, not the raw credential
  4. Never store App Registration secrets in application configuration files, environment variables, or CI/CD pipeline variables

This gives you Key Vault’s monitoring, access logging, and soft-delete protection, none of which exist for credentials stored elsewhere.

Strategy 3: Implement Automated Rotation

Manual rotation doesn’t scale. For App Registration secrets, automated rotation involves:

  1. Generate a new client secret via Microsoft Graph API
  2. Store the new secret as a new version in Key Vault
  3. Wait for the overlap window (both old and new credentials valid simultaneously)
  4. Propagate to consuming applications (restart App Services, update Container App revisions)
  5. Verify that consumers are using the new credential
  6. Remove the old credential from the App Registration

This workflow requires orchestration across Microsoft Graph, Key Vault, and Azure Resource Manager, which is three different APIs with different authentication requirements. Building this yourself is certainly possible, but it’s a meaningful engineering investment to handle failure scenarios, retry logic, rollback, and audit logging correctly.

Strategy 4: Continuous Discovery and Monitoring

Even with good hygiene, new credentials get created. You need continuous monitoring to catch:

  • New App Registrations created without following naming conventions or ownership requirements
  • Credentials added outside of your rotation pipeline, e.g., a developer manually adding a secret through the portal
  • Approaching expiry dates that haven’t been picked up by rotation automation
  • Orphaned App Registrations that no longer serve a purpose but still have valid credentials

The CertifyClouds Approach

CertifyClouds tackles App Registration credential sprawl as part of its unified secret lifecycle platform:

Discovery scans your entire Entra ID tenant to inventory every App Registration, its credentials (secrets and certificates), expiry dates, and ownership. Results are correlated with Key Vault contents to show which credentials are stored securely and which are floating.

Dependency mapping traces the connection from App Registration to Key Vault secret to consuming App Service / Function / Container App. When you rotate a credential, you see exactly what will be affected.

Automated rotation handles the full workflow: generate new credential, store in Key Vault, propagate to consumers, verify, and clean up the old credential. Zero-downtime overlap windows are configurable per secret.

Compliance scoring gives you a single metric for your credential hygiene: percentage of secrets within rotation policy, secrets without expiry, secrets with excessive lifetime, and orphaned credentials.

Start Small, Think Big

Credential sprawl isn’t solved overnight. Start with these concrete steps:

  1. Inventory: run az ad app list --all and count how many App Registrations have expired or expiring credentials. The number will likely surprise you
  2. Triage: identify which App Registrations are used in production and prioritize those for lifecycle management
  3. Migrate to Managed Identities where possible. Every App Registration you eliminate is one less credential to manage
  4. Centralize remaining credentials in Key Vault with expiry tracking
  5. Automate rotation for the highest-risk credentials first

Or, skip the spreadsheet phase: CertifyClouds gives you the full picture of every App Registration, every credential, every dependency, in a single scan. Start with the free Starter tier and see your credential landscape in minutes.

Further Reading