App registration secrets rotation cadence

Overview

Client secrets in app registrations are frequent breach pivots. Automate rotation reminders.

Standard

• Max 180-day secret lifetime unless vendor forbids shorter.
• Prefer managed identities and certificates over long-lived secrets.

Process

1. Inventory owners for each app registration.
2. Calendar tickets 30 days before expiry with test checklist.

Emergency

If secret leaked, rotate both secret and review sign-in logs for abuse.

Documentation

Central CMDB linking app → registration ID → owners.