Test-MtEntraAgentBlueprintCredentialHygiene
SYNOPSIS
Audits Agent Identity Blueprints for expired, stale, or excessive client credentials.
SYNTAX
Test-MtEntraAgentBlueprintCredentialHygiene [[-MaxActiveSecrets] <Int32>] [[-MaxValidityDays] <Int32>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Checks whether Agent Identity Blueprints have expired client secrets, credentials with excessively long validity periods (>730 days), more than two active client secrets, or an active client secret retained alongside a federated identity credential (FIC). Unmanaged blueprint credentials increase the blast radius and risk of credential reuse; a secret kept alongside a FIC is a live fallback that defeats the point of migrating to FIC.
EXAMPLES
EXAMPLE 1
Test-MtEntraAgentBlueprintCredentialHygiene
PARAMETERS
-MaxActiveSecrets
Maximum allowed active client secrets per blueprint. Defaults to 2.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 1
Default value: 2
Accept pipeline input: False
Accept wildcard characters: False
-MaxValidityDays
Maximum allowed validity period in days for credentials. Defaults to 730 days (2 years).
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 2
Default value: 730
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
INPUTS
OUTPUTS
System.Boolean
NOTES
RELATED LINKS
https://maester.dev/docs/commands/Test-MtEntraAgentBlueprintCredentialHygiene
https://learn.microsoft.com/graph/api/agentidentityblueprint-list?view=graph-rest-1.0