Skip to content
MitoMito Docs

MT.1198: App registration certificates should not have excessive validity periods.
ID MT.1198
Severity Medium
Suite Mito
Product Entra ID
Feature Applications
Security area Applications and workload identities
Resource type Application
User impact of fixing Low
Effort to fix Medium
Framework controls nist-800-53-r5:IA-5 Authenticator Management
MITRE ATT&CK T1649
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

This test checks if any app registration uses a certificate that was issued with an excessive validity period.

Certificates are the recommended alternative to client secrets, but a certificate that is valid for several years reintroduces the risk it was meant to remove: a stolen private key stays usable for the entire remaining validity period, and long-lived credentials are rarely rotated or reviewed.

An app management policy does not close this gap on its own. Credential restrictions carry a restrictForAppsCreatedAfterDateTime property and only apply to credentials added after the policy takes effect, so certificates that already exist are grandfathered in and are never re-evaluated. A tenant can therefore pass the app management policy test and still authenticate with multi-year certificates.

Certificates that have already expired can no longer be used to authenticate and are not reported by this test.

Remediation action

Section titled “Remediation action”
  1. Open the app registration listed below in the Microsoft Entra admin center and select Certificates & secrets.
  2. Request or generate a replacement certificate with a shorter validity period and upload it under Certificates.
  3. Update the workload that authenticates with the app registration to use the new certificate.
  4. Once the workload has been confirmed to work, delete the long-lived certificate.
  5. Configure the default app management policy with an asymmetricKeyLifetime restriction so that new certificates cannot be added with an excessive validity period.
  6. Where possible, replace certificate authentication with a managed identity or workload identity federation, which removes the credential entirely.

Learn more

Section titled “Learn more”

Mito check. Author: simon-vedder. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.