Forum Discussion
Security App Registrations
Hello, I am reaching to see what people are doing around security app registrations. We've been working with our Dev teams, and have come across this app registration that's highly secure. Our devel...
Hello bglmarks ,
I am using this type of flow.
I think your concerns are controlled by permissions.
You should have Active Directory permission on your Azure Portal users to restrict who can create the App Registrations.
Then once you have generated the App Registration plus the Client Secret, you need to secure these somewhere safe like encrypted database or better would be Azure Key Vault.
You would then also want to limit what the Client can do to make sure it cannot create or destroy everything.
For example, only the Admin in our AD can create the App Reg, so I can't create them. The Service Principle only has read access to a certain Subscription. The details are then saved securely for use, so we cannot read them while using in the code.
cpateman Thank you for your response, once you have the keyvault and secret stored within, how do you then secure the keyvault. As long as the developer has access to the keyvault, couldn't they programmatically get access to that from anywhere? is there a way to keep keyvault behind conditional access so that access is only accessible internally?
- There is no way to integrate Service Principals with Conditional Access. You can monitor sign-ins however to make sure that the service principals aren't used from an unknown IP.
Check this out for an example: https://thecollective.eu/blog/monitoring-service-principals-with-watchlists-in-azure-sentinel/
