IAM-05 · Autumn Solutions

Identity Threat & Workload Security

I built a Python-based Microsoft Entra workload identity assessment that evaluates application registrations, service principals, credential lifecycle, ownership, and Microsoft Graph permissions. The assessment identified 15 security findings and drove remediation through least privilege, credential rotation, ownership governance, and formal risk acceptance.

View Evidence View GitHub Watch Walkthrough
15
Baseline findings
5
Applications assessed
5
Service principals assessed
0
Unresolved findings
Video Walkthrough · 2–3 min

See the project in action

A concise walkthrough of the architecture, Microsoft Entra configuration, controls, and validation evidence behind this project.

Open on YouTube ↗
01 / Challenge

Assess the identities behind applications, not just users.

Workload identities can hold powerful directory permissions without the authentication controls used for human accounts. Autumn Solutions needed a repeatable way to identify application ownership gaps, stale credentials, excessive permissions, and credentials approaching expiration.

Microsoft Entra ID Microsoft Graph Python MSAL Service Principals App Registrations OAuth 2.0
02 / Solution

Purpose-built workload identity assessment.

The assessor uses a dedicated read-only Entra application with interactive delegated authentication, then queries Microsoft Graph for applications, local service principals, owners, credentials, and application permissions. Findings are classified and exported to structured JSON and CSV reports.

IAM-05 workload identity assessment architecture showing delegated read-only Microsoft Graph discovery and a separate administrator remediation cycle
03 / Remediation

Findings were validated before changes were made.

01

Stale Secret Removal

Verified that the lifecycle automation had already migrated to X.509 certificate authentication, then removed the obsolete client secret without disrupting the workload.

02

Ownership Governance

Assigned a named IAM engineer as technical owner across the relevant application registrations and enterprise application service principals.

03

Least Privilege

Removed redundant Microsoft Graph application permissions, revoked their existing consent grants, then obtained a new certificate-authenticated token to validate the reduced role set.

04

OIDC Secret Rotation

Rotated the LedgerFlow OIDC credential, tested a successful user sign-in with the new secret, and only then removed the previous credential.

04 / Risk Governance

Required privilege remained visible instead of being hidden.

The remaining User.ReadWrite.All application permission is required by the Joiner, Mover, Leaver workflow to create, update, and disable Entra users. Removing it simply to achieve a zero-finding scanner would break the business process.

Accepted High-Impact Permission

The permission was formally documented with a business justification, technical owner, review date, and compensating controls.

  • Certificate-based workload authentication
  • No client secret
  • Dedicated application identity
  • Named technical owner
  • Reduced Microsoft Graph permission set
  • Structured lifecycle audit logging
05 / Evidence

Assessment and remediation evidence.

Initial workload identity assessment showing baseline findings
Baseline assessment: 15 findings across five applications and five local service principals.
Certificate authenticated token validation after least privilege remediation
Token validation confirmed the reduced Microsoft Graph application permission set while required Graph operations continued to return HTTP 200.
Successful LedgerFlow OIDC sign in after client secret rotation
Successful LedgerFlow OIDC authentication after controlled client-secret rotation and before removal of the old credential.
Final workload identity assessment with no unresolved findings
Final governed state: zero unresolved findings and one formally accepted business-required high-impact permission.
Outcome

15 detected findings to zero unresolved findings.

The project combined workload identity discovery, Microsoft Graph permission analysis, service principal governance, credential lifecycle management, least-privilege remediation, controlled credential rotation, technical validation, and formal risk acceptance. The result is a workload identity program that treats non-human identities as governed security principals rather than background application objects.

Explore View GitHub View All IAM Projects