How do you detect credentials being added to an existing Microsoft Entra application?

How to spot credential additions in Entra update activity

Detection starts with treating every Microsoft Entra application update as a potential identity change event, not just a configuration edit. The signal you want is the addition of a new secret, certificate, or key credential to an existing app registration or enterprise application, especially when that app is already in production and should not be changing often.

Build the review around three questions: who made the change, whether the app was expected to receive a new credential, and whether the app already had another valid credential in place. That combination separates routine rotation from suspicious persistence. For Entra-specific context on applications, consent, and app exposure, see the Entra ID Applications and Consent Guide.

The most useful telemetry is the update trail that records application object changes, alongside the actor, timestamp, and changed properties. Watch for new credential material on privileged apps, unattended apps, and applications that authenticate to Graph, Azure, or other high-value services. When the app is supposed to be long-lived, any fresh credential addition deserves immediate comparison against your change calendar, rotation schedule, and owner approvals.

What makes a credential addition suspicious

A credential addition becomes suspicious when it breaks the app's normal lifecycle. Common red flags include a new secret or certificate added outside a maintenance window, a credential added to an app that was previously stable, or a change made by an account that does not normally manage that application. An attacker who gains access to an Entra tenant often adds a credential so the app survives password resets or user account cleanup.

It is also worth checking whether the application is already holding valid credentials. If an app suddenly accumulates multiple overlapping secrets or certificates, that can indicate either sloppy rotation or deliberate persistence. The distinction matters because a second credential can let an intruder retain access even after the original compromise path is closed. Microsoft-oriented attack writeups such as the Storm-1283 OAuth apps abuse 2023 case show how added app credentials can be used to keep access and operate at scale.

For app registrations and service principals, the practical question is not only whether a credential was added, but whether the app's privilege set makes that addition dangerous. A low-risk utility app and a highly privileged automation app should not be judged the same way. The Azure RBAC and Service Principals Guide is useful when you need to connect credential changes to scope, role assignment, and blast radius.

How to investigate and validate the change

Once you see a new credential, validate it against the app's intended ownership and use case. Confirm whether the person or automation that made the change is an approved owner, whether the change ticket exists, and whether the credential type matches the pattern your team normally uses. A certificate added to an app that usually uses client secrets, or a secret added to a certificate-only app, is a useful clue that the change may not be operationally normal.

Then inspect whether the credential was added to an app with existing sign-in or Graph access and whether the app has been active recently. A credential addition on a dormant application is more concerning than a change on a well-managed, high-frequency integration. Historical abuse cases, including the Malwarebytes breach 2021 incident, show why dormant apps and service principals deserve special scrutiny when new credentials appear.

For the surrounding control model, align your investigation with the relevant Microsoft identity and application permissions guidance. OWASP Non-Human Identity Top 10 is a useful external reference when you want to think about secret leakage, overprivilege, and rotation as part of the same detection problem rather than separate ones.

Risk and Threat Considerations

A newly added credential can convert a one-time compromise into durable access. That is especially true when the attacker adds a secret or certificate to an existing app registration, because the app can continue authenticating even after the original compromised user or session is removed.

Failure mechanism: The adversary uses an update path on the application object to introduce fresh authentication material, then relies on the app's existing permissions and trust to persist access without further user interaction.

Impact: The result can be stealthy long-term access to Graph, cloud resources, data, or automation workflows, plus delayed detection because the change may look like a normal lifecycle event unless it is tied back to ownership and change control.

Practitioner Guidance

What to verify: Require the alert to show the actor, app identifier, credential type, and whether the application already had valid credentials. If the app is privileged, unattended, or rarely changed, treat the event as high priority until ownership and intent are confirmed.

Decision rule: If the new credential is not matched to an approved rotation or build process, assume it is a persistence attempt until proven otherwise. In that case, rotate or revoke the credential, inspect sign-in and audit activity around the app, and check whether the app has been used from unexpected locations or principals.

Practitioner takeaway: The best detector is not just "new credential added", it is "new credential added where the app, the actor, and the timing do not fit the app's normal lifecycle."

Related resources from NHI Mgmt Group

• How should security teams detect abuse of Microsoft application credentials in Entra ID before persistence is established?
• How do you detect a Temporary Access Pass being added to an account in Microsoft Entra ID?
• How do you detect application URI configuration changes in Microsoft Entra ID?
• How do you apply least privilege to application permissions in Microsoft Entra ID?