Skip to content
MitoMito Docs

MT.1208: Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview).
ID MT.1208
Severity Medium
Suite Mito
Product Entra ID
Feature Agent identities
Security area AI and agents
Resource type Agent
User impact of fixing Low
Effort to fix Medium
Framework controls nist-800-53-r5:IA-5 Authenticator Management
MITRE ATT&CK T1078.004, T1098.001, T1552
Reads from Microsoft Graph
Lifecycle Preview

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Agent Identity Blueprints should not have expired, excessive, or overly long-lived client credentials.

Credentials on Agent Identity Blueprints are used for token exchange to authenticate all child Agent Identities. If a blueprint accumulates expired secrets, secrets valid for years without rotation, or an excessive number of active secrets, the risk of credential compromise and unmanaged persistence increases significantly.

This check inspects the credential metadata of all Agent Identity Blueprints in the tenant to identify expired secrets, credentials valid for more than 730 days (2 years), blueprints with more than 2 active secrets, or a blueprint that retains an active client secret alongside a federated identity credential (FIC).

Remediation action:

Section titled “Remediation action:”
  1. Open the Microsoft Entra admin center and navigate to Entra ID > Agents > Agent blueprints.
  2. Locate the reported Blueprint using its Object ID or display name.
  3. Under Developer settings, select Credentials.
  4. On the Certificates and Client secrets tabs, delete any expired credentials that are no longer in use.
  5. If secrets have validity periods longer than your organization’s maximum rotation window (recommended ≤ 365–730 days), create a new secret and decommission the old one.
  6. Prefer using Federated credentials or Certificates instead of shared client secrets wherever supported. If a federated credential is already configured, remove the remaining client secret entirely rather than keeping it as a fallback.
Section titled “Related links”

Mito check. Author: agnivesh. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.