NIST SP 800-53 Rev. 5 · Identification and Authentication
IA-5(1) on Microsoft Sentinel
Credentials past required rotation — a published KQL query you can run against Microsoft Sentinel / Log Analytics, with the evidence it needs, the settings you decide, and what a result does and does not establish.
Why this matters
A password or key still in use long past the date it should have been replaced
Applications and automated systems sign in using long-lived keys rather than passwords typed by a person. These are created once, pasted into a configuration file, and forgotten. They frequently outlast the project, the vendor, and the employee who created them, and a key that leaks stays useful to whoever finds it for as long as it remains valid.
Why this check earns its place. Nobody receives a reminder that an application key is ageing. There is no login prompt to nag anyone, so the only way to find them is to go looking.
- What it reads
- The organization's own inventory of application keys and when each was created.
- What it reports
- Keys older than the organization's own replacement interval, and keys about to stop working without warning.
See related public disclosures on the Signals page →
What this finds
Active credential older than the rotation interval, or approaching hard expiry.
The requirement
The organization must enforce authenticator lifetime restrictions and require authenticators to be changed or refreshed at an organization-defined frequency.
NIST SP 800-53 Rev. 5 — IA-5(1) (Authenticator Management | Password-Based Authentication).
NIST requires a defined refresh frequency without setting it. The 90-day rotation interval below, and any exemption for credentials managed by an automated rotation service, are local decisions.
How this maps to the CISA performance goals
The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:
- 3.C — Create unique credentials (partial — see note)
CPG 2.0 has NO goal for credential rotation age. Current NIST guidance moved away from forced periodic rotation, so this pack answers an organization-defined policy rather than a CPG. Mapped here only because both concern credential hygiene -- do not present it as satisfying 3.C.
See the full coverage map, including the goals no query can answer →
Evidence this query needs
None. This query runs on platform telemetry alone — there is no file to prepare and nothing to export.
The query
Published as ia-5-1-credential-rotation.azure.kql. Reads AppCredentialInventory_CL (app-credential inventory export). Requires: Log Analytics Reader.
Before this returns anything,
AppCredentialInventory_CL (app-credential inventory export) has to be reaching Microsoft Sentinel / Log Analytics. If not, the query reports nothing found — which looks
exactly like nothing wrong. What has to be switched on first →
// IA-5(1) -- application credentials past the rotation interval
// Requires an app-credential inventory. Microsoft Graph does not expose
// secret ages through Sentinel natively; land the export via a scheduled
// Logic App calling /applications and reading passwordCredentials.
let RotationDays = 90;
let GraceDays = 14;
AppCredentialInventory_CL
| where TimeGenerated > ago(2d)
| summarize arg_max(TimeGenerated, *) by CredentialId_s
| extend CreatedOn = todatetime(CreatedDateTime_t),
ExpiresOn = todatetime(EndDateTime_t),
AppName = tostring(DisplayName_s),
Managed = tobool(column_ifexists("ManagedRotation_b", false))
| where Managed != true
| extend AgeDays = datetime_diff('day', now(), CreatedOn)
| extend DaysToExpiry = iff(isnull(ExpiresOn), int(null),
datetime_diff('day', ExpiresOn, now()))
| where AgeDays > RotationDays
or (isnotnull(DaysToExpiry) and DaysToExpiry <= GraceDays)
| project AppName, CredentialId_s, CreatedOn, ExpiresOn,
AgeDays, DaysToExpiry,
SourceSystem = "Microsoft Entra ID"
| order by AgeDays descOpen this pack on Microsoft Sentinel to adjust the settings and download it →
The interactive version opens on Microsoft Sentinel — the platform on this page — even if your environment profile does not list it.
Settings you decide
NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.
- Rotation interval (days) (default 90)
- Credentials older than this are reported.
- Expiry warning window (days) (default 14)
- Credentials approaching hard expiry within this window are also reported.
Running it continuously
Sentinel scheduled analytics rule
Rule type: Scheduled query rule
Run frequency: Every 24 hours
Lookup period: Last 2 days (latest inventory snapshot)
Trigger: Number of query results > 0
Entity mapping: CloudApplication -> AppName
Severity: Medium
Incident: Create incident, group by CloudApplication
Suppression: 7 days per credentialReports both credentials past rotation age and credentials approaching hard expiry — the second case is an availability risk as much as a security one, and teams usually want the same warning.
What a result does not prove
Credential age alone does not indicate compromise. It indicates that the organization's own rotation requirement has not been evidenced for this credential.
Validation status for this platform: Not tenant-validated. Structure, query generation, and preflight are covered by the project's automated test suites. This pack has not been executed against a live tenant, account, or index. Validate it in a non-production scope before relying on any result.
Before you act on a result
- Is the credential under an automated rotation service this query does not see?
- Is the credential still in use, or is it an orphan that should be deleted rather than rotated?
- Would rotation break a dependency that needs coordinated change?
- Is there a documented exception with an expiry?
Common questions
- How do I check for credentials past required rotation in Microsoft Sentinel?
- Run the published KQL query on this page against Microsoft Sentinel / Log Analytics. It reads AppCredentialInventory_CL (app-credential inventory export) and reports: Active credential older than the rotation interval, or approaching hard expiry.
- What permissions are needed to run this Microsoft Sentinel query?
- Log Analytics Reader.
- Does a result from this query mean the control has failed?
- Credential age alone does not indicate compromise. It indicates that the organization's own rotation requirement has not been evidenced for this credential.
Terms used on this page
- NIST SP 800-53the U.S. federal catalogue of security requirements
- The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
- CISACybersecurity and Infrastructure Security Agency
- The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
- KQLKusto Query Language
- The language used to ask questions of data held in Microsoft Sentinel. A query written in it is text, like a spreadsheet formula, and can be read before it is run.
- CPGCross-Sector Cybersecurity Performance Goals
- A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
- not tenant-validatednever executed against real data
- The check has passed the project's automated tests for structure and syntax, but has never been run against real data anywhere. Test it in a safe scope before relying on any result.
The same control on other platforms
- IA-5(1) on AWS — SQL (Athena) + Lambda
- IA-5(1) on Splunk — SPL
- All platforms for IA-5(1)