azure.entraid-service-principal

EntraID service principal (enterprise application) resource.

Service principals are the tenant-local identities of applications. They can carry their own password and key credentials, which are not shown in the Azure portal and are typically added through the CLI or API.

Permissions: - Application.Read.All for reading service principals

example:

Find service principals with credentials that expire within the next 14 days, ignoring credentials that have already expired:

policies:
  - name: entraid-sp-credentials-expiring
    resource: azure.entraid-service-principal
    filters:
      - type: credential-expiration
        days: 14
        include-expired: false
example:

Find disabled service principals:

policies:
  - name: entraid-sp-disabled
    resource: azure.entraid-service-principal
    filters:
      - type: value
        key: accountEnabled
        value: false

Filters

advisor-recommendation

Filter resources by Azure Advisor Recommendations

Select all categories with ‘all’

example:

policies:
  - name: disks-with-cost-recommendations
    resource: azure.disk
    filters:
      - type: advisor-recommendation
        category: Cost
        key: '[].properties.recommendationTypeId'
        op: contains
        value: '48eda464-1485-4dcf-a674-d0905df5054a'

properties:
  category:
    type: string
  default:
    type: object
  key:
    type: string
  op:
    enum:
    - eq
    - equal
    - ne
    - not-equal
    - gt
    - greater-than
    - ge
    - gte
    - le
    - lte
    - lt
    - less-than
    - glob
    - regex
    - regex-case
    - in
    - ni
    - not-in
    - contains
    - difference
    - intersect
    - mod
  tag_key_transforms:
    items:
      type: string
    type: array
  type:
    enum:
    - advisor-recommendation
  value:
    oneOf:
    - type: array
    - type: string
    - type: boolean
    - type: number
    - type: 'null'
  value_from:
    additionalProperties: 'False'
    properties:
      expr:
        oneOf:
        - type: integer
        - type: string
      format:
        enum:
        - csv
        - json
        - txt
        - csv2dict
      headers:
        patternProperties:
          ? ''
          : type: string
        type: object
      query:
        type: string
      url:
        type: string
    required:
    - url
    type: object
  value_path:
    type: string
  value_regex:
    type: string
  value_type:
    enum:
    - age
    - integer
    - expiration
    - normalize
    - size
    - cidr
    - cidr_size
    - swap
    - resource_count
    - expr
    - unique_size
    - date
    - version
    - float
    - duration
required:
- category
- type

credential-expiration

Filter by client secrets and certificates that expire within a number of days.

A resource matches when at least one of its credentials has an endDateTime within days days from now. Credentials that have already expired match as well unless include-expired is set to false. credential-type limits the check to client secrets (password) or certificates (key).

The matching credentials are added to the resource under c7n:ExpiringCredentials with their type, keyId, displayName, endDateTime and daysRemaining (negative once expired), so notifications can say which credential needs rotating.

example:

Find application registrations with a client secret that has already expired:

policies:
  - name: entraid-app-expired-secrets
    resource: azure.entraid-application
    filters:
      - type: credential-expiration
        days: 0
        credential-type: password

properties:
  credential-type:
    enum:
    - all
    - password
    - key
    type: string
  days:
    minimum: 0
    type: number
  include-expired:
    type: boolean
  type:
    enum:
    - credential-expiration
required:
- days
- type

Actions