Principal Problems: App Registrations, Service Principals, and the Hidden Risk of Multi-Tenant Apps
SpecterOps dissects how Entra ID app registrations vs. service principals create hidden cross-tenant risk—illustrated by the ConnectWise Cloud Backup credential compromise.
Summary written by editorial AI · Source link below
TL;DR: App registrations are an app’s blueprint and hold its credentials in one home tenant. Service principals (what you see under Enterprise applications) are the identities that hold permissions in every tenant that uses the app, which is why one stolen credential in the ConnectWise Cloud Backup incident reached 100+ tenants. What are we talking […] The post Principal Problems: App Registrations, Service Principals, and the Hidden Risk of Multi-Tenant Apps appeared first on SpecterOps .
Editorial Analysis
Framed for the DevSecOps Engineer desk
Developers often conflate app registrations with service principals, inadvertently granting excessive cross-tenant permissions that persist long after initial onboarding.
Audit app registrations for overly broad API permissions and rotate credentials; enforce workload identity federation where possible.
A single compromised credential in a multi-tenant cloud app can give attackers access across every tenant that consented to it—review your Entra ID consents.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at SpecterOps in a new tab.
More from the Cloud Desk
- Addressing protocol security gaps in multi-tenant Kubernetes3d
- LLMjacking Emerges as Thriving Cybercriminal Enterprise6d
- Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs6d
- Inside a successful AWS European Sovereign Cloud exercise to demonstrate independent operation2 Nov
- Northflank security breach leads to abuse of customers' AI API keys31 Oct