Azure ● Sealed v1.0

Azure Service Principal Credentials

Secrets and certificates associated with Azure AD Application Registrations

What it does

Discovers secrets and certificates associated with Azure AD Application Registrations. Identifies expiration dates, credential types, and hints for lifecycle management. Migration-useful shape (v1.3.0): - ApplicationObjectId (directory object id) + AppId (client id) + TenantId - ManagerId = ApplicationObjectId so Export-DiscoveryResult fills _ParentAnchorID - IsExpiringSoon (90d) / IsExpiringCritical (30d) for rotation planning - Certificate CustomKeyIdentifier + Usage - App-level AppCredentialSummary rows (counts, earliest expiry, parent = TenantId) - Denormalized SignInAudience / PublisherDomain / AppCreatedDateTime on credential rows

How the app exposes it

The module feeds into the ACQI app's dedicated results view. From there, conflicts, dependencies, and readiness scores roll up into the deal workspace.

Route in app:
/discovered/azure-service-principal-creds

Outputs

Each module produces a CSV with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact columns vary by module — the app's results view shows the live schema.