MT.1057: App registrations should no longer use secrets.
| ID | MT.1057 |
| Severity | Medium |
| Suite | Mito |
| Product | Entra ID |
| Feature | Applications |
| Security area | Applications and workload identities |
| Resource type | Application |
| User impact of fixing | Low |
| Effort to fix | High |
| Framework controls | nist-800-53-r5:IA-5 Authenticator Management |
| MITRE ATT&CK | T1078.004, T1552 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”This test checks if you have any app registrations that have secrets configured. Using secrets is discouraged! There are better ways available to authenticate your applications.
Remediation action
Section titled “Remediation action”Open all app registrations below and remove the secrets.
Mito check. Author: svrooij. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.