Microsoft Entra recommendation: Remove unused credentials from apps (preview)

Applications that the recommendation identified appear in the list of Impacted resources at the bottom of the recommendation.

1. Sign in to the Microsoft Entra admin center as at least a Security Administrator.

2. Browse to Identity > Overview.

3. Select the Recommendations tab and select the Remove unused credentials from applications recommendation.

4. Take note of the following details from the Impacted resources table.

   • The Resource column displays the application name
   • The ID column displays the application ID

5. Select More Details from the Actions column to view more details.

   

   Note

   If the origin of the credential is Service Principal, follow the guidance in the Service principals section.

6. From the panel that opens, select Update Credential to navigate directly to the Certificates & secrets area of the app registration to remove the unused credential.

   1. Alternatively, browse to Identity > Applications > App registrations and select the application that was surfaced as part of this recommendation.

      

   2. Then navigate to the Certificates & Secrets section of the app registration.

      

7. Locate the unused credential and remove it.

The following requests can be used to retrieve the recommendation and the impacted resources using the Microsoft Graph API. To use the Microsoft Graph API, you need the DirectoryRecommendations.Read.All and DirectoryRecommendations.ReadWrite.All permissions. For more information, see How to use Identity Recommendations.

1. Sign in to Graph Explorer.
2. Select GET as the HTTP method from the dropdown.

To retrieve all recommendations for your tenant:

GET https://graph.microsoft.com/beta/directory/recommendations

From the response, find the ID of the recommendation that matches the following pattern: {tenantId}_Microsoft.Identity.IAM.Insights.StaleAppCreds.

To identify impacted resources:

GET https://graph.microsoft.com/beta/directory/recommendations/{tenantId}_Microsoft.Identity.IAM.Insights.StaleAppCreds

To filter the resources based on their status (for example, active resources):

GET https://graph.microsoft.com/eta/directory/recommendations/536279f6-15cc-45f2-be2d-61e352b51eef_Microsoft.Identity.IAM.Insights.StaleAppCreds/impactedResources?$filter=status eq Microsoft.Graph.recommendationStatus'active'

• Take note of the AppId, CredentialId, and origin of the credential you want to remove.
• Use these Microsoft Graph APIs to add a new password or key credential:
  • removePassword
  • removeKey

{
  "id": "536279f6-15cc-45f2-be2d-61e352b51eef_Microsoft.Identity.IAM.Insights.StaleAppCreds",
  "recommendationType": "staleAppCreds",
  "createdDateTime": "2022-09-07T21:25:36Z",
  "impactStartDateTime": "2022-09-07T21:25:36Z",
  "postponeUntilDateTime": null,
  "lastModifiedDateTime": "2024-07-22T15:23:29Z",
  "lastModifiedBy": "System",
  "displayName": "Remove unused credentials from applications",
  "featureAreas": [
    "applications"
  ],
  "insights": "Your tenant has applications with credentials which have not been used in more than 30 days.",
  "benefits": "An application credential is used to get a token that grants access to a resource or another service.",
  "category": "identityBestPractice",
  "status": "active",
  "priority": "medium",
  "releaseType": "preview",
  "requiredLicenses": "microsoftEntraWorkloadId",
  "impactType": "apps",
  "actionSteps": [
    {
      "stepNumber": 1,
      "text": "1. For application resources, navigate to the app registration section in your tenant."
    },
    {
      "stepNumber": 2,
      "text": "2. In the ‘Certificate and Secrets’ blade, find the credential and remove it."
    },
    {
      "stepNumber": 3,
      "text": "3. To remove a credential from a service principal resource, use the MS Graph Service Principal API service action ",
      "actionUrl": {
        "displayName": "`removePassword`",
        "url": "https://docs.microsoft.com/graph/api/serviceprincipal-removepassword?view=graph-rest-1.0&tabs=http"
      }
    }
  ]
}