Establish ongoing credential rotation and hygiene process
Implementation Effort: Medium – Standing up rotation schedules, automating rotation through Key Vault, and migrating long-lived secrets to managed identities is a multi-step effort spanning pipeline, application, and platform owners. User Impact: Low – Credential rotation and hygiene are carried out by administrators and automation; end users are not affected. Lifecycle Stage: Code
Overview
Establish an ongoing credential rotation and hygiene process for development, pipeline, and application secrets. Rotate secrets on a defined, risk-based schedule, remove unused credentials, and replace long-lived secrets with managed identities or workload identity federation wherever possible.
Secrets, tokens, and service credentials used across the development lifecycle—pipeline service connections, API keys stored in variable groups, deployment credentials, and application secrets in key vaults—tend to become permanent fixtures once they are working. Teams are often reluctant to rotate credentials that power production pipelines because misconfiguration during rotation can cause outages. The result is an environment where long-lived credentials persist for months or years, giving threat actors an extended window to discover, steal, and exploit them.
Define rotation intervals by credential type and sensitivity, and automate the process where possible. Azure Key Vault supports automated rotation patterns through Event Grid integration and automation, which reduces dependence on manual reminders and ad hoc engineering work. Where the platform supports it, replace long-lived secrets entirely with managed identities or workload identity federation so there is no stored credential to rotate.
Beyond rotation schedules, credential hygiene includes identifying and removing orphaned secrets that belong to decommissioned services, consolidating duplicate credentials that serve the same purpose, and ensuring that every active credential is stored in a managed secret store rather than embedded in pipeline definitions or configuration files. Where possible, the most effective hygiene action is to eliminate the secret entirely by migrating to identity-based authentication — Workload Identity Federation for CI/CD pipelines, federated credential migration for existing service principals, and managed identities for Azure resource deployments all remove stored secrets from the equation. This directly supports Assume breach by limiting the useful life of any compromised secret, and it reinforces Use least privilege access by ensuring credentials are scoped to only the permissions and lifetime they require.