Procedure and the consequence when Rotating the keyCredentials in Azure Active Directory?

Question

Procedure and the consequence when Rotating the keyCredentials in Azure Active Directory?

EnterpriseArchitect 6,061

Hi All,

I have received the email from Microsoft for the Action required: Rotate your keyCredentials in Azure Active Directory.

I wonder what the procedure and impact will be when executing it as we have an Azure production environment globally so it is running 24x7.

Any help would be greatly appreciated.

EnterpriseArchitect 6,061 Reputation points

2023-11-16T23:57:23.7+00:00

Hi @Carlos Solis Salazar ,
Thank you for the update, using this script https://gist.github.com/merill/8306cc91030b0a3e12f47835db6af549 I can see the result for the Application has some IsExpired FALSE:

What will be the impact?
Carlos Solís Salazar 18,201 Reputation points MVP Volunteer Moderator

2023-11-17T13:41:56.47+00:00

Means it hasn't expired yet.

if you look at the EndDateTime field, you can see the expiration date, the next one that is about to expire is the one on the first line.

Accept the answer if the information helped you. This will help us and others in the community as well.
EnterpriseArchitect 6,061 Reputation points

2023-11-17T13:44:57.8666667+00:00

Thank you @Carlos Solis Salazar ,
Is this Rotating KeyCredentials only applicable to the object with the KeyVault?
Carlos Solís Salazar 18,201 Reputation points MVP Volunteer Moderator

2023-11-17T15:12:10.93+00:00

You can do it manually directly in the app service, however if you want to automatize, you will need a KeyVault

Accept the answer if the information helped you. This will help us and others in the community as well.
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2023-11-21T05:44:26.76+00:00

Hi @EnterpriseArchitect ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
EnterpriseArchitect 6,061 Reputation points

2023-11-21T05:54:30.0666667+00:00

Hi @Carlos Solis Salazar ,
OK, regarding rotating the Application Registration blade, I can only see there is just 'Upload Certificate' option, there is no Key Vault integration or setting:

Therefore, I assume this must be manually imported from the Key Vault?

Accepted answer

1 additional answer

Your answer

EnterpriseArchitect 6,061 Reputation points

2023-11-16T23:57:23.7+00:00

Hi @Carlos Solis Salazar ,
Thank you for the update, using this script https://gist.github.com/merill/8306cc91030b0a3e12f47835db6af549 I can see the result for the Application has some IsExpired FALSE:

What will be the impact?
Carlos Solís Salazar 18,201 Reputation points MVP Volunteer Moderator

2023-11-17T13:41:56.47+00:00

Means it hasn't expired yet.

if you look at the EndDateTime field, you can see the expiration date, the next one that is about to expire is the one on the first line.

Accept the answer if the information helped you. This will help us and others in the community as well.
EnterpriseArchitect 6,061 Reputation points

2023-11-17T13:44:57.8666667+00:00

Thank you @Carlos Solis Salazar ,
Is this Rotating KeyCredentials only applicable to the object with the KeyVault?
Carlos Solís Salazar 18,201 Reputation points MVP Volunteer Moderator

2023-11-17T15:12:10.93+00:00

You can do it manually directly in the app service, however if you want to automatize, you will need a KeyVault

Accept the answer if the information helped you. This will help us and others in the community as well.
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2023-11-21T05:44:26.76+00:00

Hi @EnterpriseArchitect ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
EnterpriseArchitect 6,061 Reputation points

2023-11-21T05:54:30.0666667+00:00

Hi @Carlos Solis Salazar ,
OK, regarding rotating the Application Registration blade, I can only see there is just 'Upload Certificate' option, there is no Key Vault integration or setting:

Therefore, I assume this must be manually imported from the Key Vault?

Answer 1

This process generally involves updating the credentials (like secrets or certificates) used by applications to authenticate with Azure AD. Here's a guide on how to proceed and what to consider, especially given that you have a global Azure production environment running 24x7:

Procedure for Rotating KeyCredentials

1. Identify Affected Applications

Determine which applications use the keyCredentials that need to be rotated. This could include applications that authenticate using Azure AD for various services.

2. Generate New Credentials

Go to the Azure portal and navigate to the Azure Active Directory section.
Find the application registration(s) affected.
Under the "Certificates & secrets" tab, generate new client secrets or upload new certificates, as applicable.
Note down the new credentials securely.

3. Update Applications with New Credentials

Update the applications with the new credentials. This step will vary depending on how each application is configured.
If possible, test the updated credentials in a staging or development environment before deploying them to production.

4. Monitor Applications Post-Update

After updating the credentials in the applications, monitor them closely for any sign of issues or authentication failures.

Impact and Considerations

1. Minimizing Downtime

Plan the update during a maintenance window or low-traffic period if possible, to minimize impact.
Some modern applications can refresh their credentials without needing a restart, but this depends on how the application is designed.

2. Backup Old Credentials

Keep the old credentials active while you make the transition to the new ones. This will allow for a fallback in case of any issues with the new credentials.

3. Communication

Inform relevant stakeholders and teams about the planned changes and potential impacts.

4. Testing

Ensure thorough testing in a non-production environment to validate that applications work correctly with the new credentials.

5. Rollback Plan

Have a rollback plan in case you encounter unexpected issues during or after the update.

6. Documentation

Update any documentation to reflect the changes made.

7. Compliance and Auditing

Record the change for compliance and auditing purposes.

8. Removing Old Credentials

Once you are confident that the new credentials are working as expected, remove the old credentials from Azure AD to maintain security.

References

By carefully planning and executing this process, you can rotate the keyCredentials with minimal impact on your production environment.

Accept the answer if the information helped you. This will help us and others in the community as well.

EnterpriseArchitect 6,061 Reputation points

2023-11-28T23:40:28.1466667+00:00

Thank you @Carlos Solis Salazar

Answer 2

Akshay-MSFT 17,961 Microsoft Employee Moderator

@EnterpriseArchitect

As Answered in https://learn.microsoft.com/en-us/answers/questions/1432879/automating-the-certificates-or-client-secrets-rota?comment=question

Currently we don't have an option to import or rotate certificate from Azure Key Vault for an Entra ID registered application, however we could use a federated credential from Key Vault.

Using a Customer managed keys to encrypt data in your tenant using Azure Key Vault in another tenant. This could be done via a managed identity.

User's image

Once Setup, Now you could Navigate to your Keys in KeyVault and setup a rotation policy for the same:

User's image

Thanks,

Akshay Kaushik

Please "Accept the answer(Yes)" and "share you feedback ". This will help us and others in the community as well.

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2023-11-28T21:34:08.2666667+00:00

@EnterpriseArchitect

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Share via

Procedure and the consequence when Rotating the keyCredentials in Azure Active Directory?

Procedure for Rotating KeyCredentials

1. Identify Affected Applications

2. Generate New Credentials

3. Update Applications with New Credentials

4. Monitor Applications Post-Update

Impact and Considerations

1. Minimizing Downtime

2. Backup Old Credentials

3. Communication

4. Testing

5. Rollback Plan

6. Documentation

7. Compliance and Auditing

8. Removing Old Credentials

References

1 additional answer

Your answer