Created by Claude - please verify

First-party credentials - secrets and certificates on service principals owned by Microsoft's tenants.

Required Microsoft Graph permissions

Application.Read.All — application permission, granted to the app registration with admin consent.

Licence: None.

Endpoint: GET /v1.0/servicePrincipals?$select=appOwnerOrganizationId,passwordCredentials,keyCredentials

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Credentials Added to Microsoft First-party Apps

Microsoft's own apps (Exchange, SharePoint, Teams and hundreds more) exist in every tenant as service principals. They do not need credentials from you. A secret or authentication certificate added to one lets its holder act as a trusted Microsoft app - the technique Midnight Blizzard used. App Credential Expiry lists credentials by expiry; this report flags the ones on Microsoft-owned apps.