App Credential Restriction Policies
The question it answers: Do app management policies block client secrets and cap credential lifetimes, and which apps are exempt?
Client secrets are the credential attackers steal most. App management policies can block new secrets, cap credential lifetimes and restrict identifier URIs tenant-wide - and custom policies can exempt specific apps. App Credential Expiry shows the credentials that exist; this report shows whether new weak ones can be created.
At a glance
Section titled “At a glance”| Where in the app | Entra ID › Identity Configuration › App Credential Restrictions |
| Workload | Entra ID |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Microsoft Entra Workload ID for enforcing restrictions (reading them needs no licence). |
| Report id (API and MCP) | entra.configuration.app-management-policies |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Policy | Category | Text |
| Setting / policy | Subject | Link |
| Check | Setting | Text |
| Value | Value | Text |
| Finding | Finding | Text |
| Applies to | Detail | Text |
| Date | When | Date |
| Apps | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Microsoft Entra Workload ID for enforcing restrictions (reading them needs no licence).
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Policy.Read.All | Microsoft Graph | Read your organization’s policies | |
Application.Read.All | Microsoft Graph | Read all applications |
Data sources it reads
GET /v1.0/policies/defaultAppManagementPolicyGET /v1.0/policies/appManagementPoliciesGET /v1.0/policies/appManagementPolicies/{id}/appliesTo
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/entra.configuration.app-management-policies?size=100An AI assistant reads it with the MCP tool get_report and the id entra.configuration.app-management-policies. The client needs the Read grant for Entra ID. See Using the API.