Expired Service Principal Credentials Leave PIM Role Active

Answer the Question First

Azure AD Privileged Identity Management (PIM) does not automatically revoke or deactivate a role assignment when a service principal’s password or certificate credential expires. The assignment remains active until the assignment itself expires or an administrator removes it.

Why the Gap Exists

• PIM tracks the role assignment lifecycle, not the underlying credential state.
• Microsoft Graph exposes credential expiration but has no built‑in trigger that links it to PIM assignments.
• Conditional Access policies cannot evaluate credential expiration; they only evaluate sign‑in context.

Confirmed Facts (Research Summary)

• There is no native Azure AD policy or Graph API setting that revokes a PIM assignment on credential expiry.
• Conditional Access cannot enforce a policy that closes an active PIM role when a credential expires.
• Administrators must implement custom monitoring (Graph API or PowerShell) to detect expired credentials and then remove or deactivate the corresponding PIM role assignment.

Practical Steps for This Scenario

1. Detect Expired Credentials

# Graph API query (JSON) – list credentials with expiry past today
GET https://graph.microsoft.com/v1.0/servicePrincipals/{sp-id}/appRoleAssignments?$filter=appRoleId eq 'role-id'
# Or PowerShell
Get-AzADServicePrincipal -DisplayName "MySP" | Get-AzADAppCredential | Where-Object {$_.EndDate -lt (Get-Date)}

2. Check for Active PIM Role Assignments

# List active PIM assignments for the SP
GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?$filter=principalId eq '{sp-id}' and isActive eq true

3. Deactivate or Remove the Assignment

# Delete the specific role assignment (requires Privileged Role Admin or Global Admin)
DELETE https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments/{assignment-id}

4. Automate the Process

• Create an Azure Function or Logic App that runs daily.
• Query for expired credentials.
• For each, check active PIM assignments and delete them or send an alert.
• Log actions to Azure Monitor for audit.

5. Validate the Result

• After deletion, attempt a privileged operation (e.g., read directory objects) with the service principal to confirm failure.
• Verify Azure AD sign‑in logs show no successful privileged sign‑ins post‑expiration.

What to Ask Next

Do you currently have a renewal or rotation workflow for service principal credentials that runs before the expiry date? This will determine if the automation should only alert or also block the role assignment.

Key Takeaways

• There is no built‑in revocation; you must monitor and act manually.
• Use Microsoft Graph or PowerShell to detect expired credentials and delete active PIM assignments.
• Automate the process to avoid manual gaps and add audit logs.