Application client secret

What it looks like

Descriptive pattern

^[A-Za-z0-9_.~-]{3}\dQ~[A-Za-z0-9_.~-]{31,34}$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

• Provider documented · provider-source · current · observed 2026-09-23

  Graph PowerShell Add-MgApplicationPassword SecretText examples (3 + 8Q~ + 34): Microsoft Graph PowerShell's Add-MgApplicationPassword reference (learn.microsoft.com) prints two example SecretText values, each 3 characters (equal to the printed 3-character Hint), the digit 8, the literal Q~, and 34 characters, 40 in total. The Q~ marker at offset 4 and the 8-variant's 40-character width come from these examples, not from a stated grammar. The 7Q~ 37-character previous format, the digit-to-length coupling and the body alphabet are corroborated only by Microsoft's security-utilities code (SEC101/156) and third-party tools

  • learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/add-mgapplicationpassword?view=graph-powershell-1.0provider-documentation · last read 2026-09-24 · latest outcome read · supports Microsoft Graph PowerShell's Add-MgApplicationPassword reference (learn.microsoft.com) prints two example SecretText values, each 3 characters (equal to the printed 3-character Hint), the digit 8, the literal Q~, and 34 characters, 40 in total. The Q~ marker at offset 4 and the 8-variant's 40-character width come from these examples, not from a stated grammar. The 7Q~ 37-character previous format, the digit-to-length coupling and the body alphabet are corroborated only by Microsoft's security-utilities code (SEC101/156) and third-party tools

• Provider documented · mutable-property-source · current · observed 2026-09-22

  Documentation for the one property varied in legacy twin fixtures (Purview Entra client secret definition): learn.microsoft.com states the client secret is "a combination of up to 40 characters" of letters, digits, "-", "_", "." and "~". It backs a length twin (41 characters) only; the digit+Q~ marker is example- and tool-corroborated (redact-secret#655) and the positive tier is unchanged

  • learn.microsoft.com/en-us/purview/sit-defn-azure-ad-client-secretprovider-documentation · last read 2026-09-22 · latest outcome read · supports learn.microsoft.com states the client secret is "a combination of up to 40 characters" of letters, digits, "-", "_", "." and "~". It backs a length twin (41 characters) only; the digit+Q~ marker is example- and tool-corroborated (redact-secret#655) and the positive tier is unchanged

• Tool corroborated · tool-corroboration · current · observed 2026-09-22

  Pinned scanner rules are consistent with the contract grammar (2 artifacts: gitleaks 8.30.1; trufflehog 3.97.4).

  • gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports gitleaks 8.30.1: gitleaks.toml
  • trufflesecurity/trufflehog @ v3.97.4: pkg/detectors/azure_entra/serviceprincipal/v2/spv2.goscanner-rule-source · last read 2026-09-22 · latest outcome read · supports trufflehog 3.97.4: Azure Entra Service Principal v2

• Provider documented · dossier-research · current · observed 2026-09-24

  Legacy dossier research (verdict ready, tier T1) cited 2 sources; the dossier does not attribute sources to individual properties.

  • redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/655/README.mdproject-research-note · last read 2026-09-24 · latest outcome read · supports Final research evidence recorded by the legacy dossier
  • learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/add-mgapplicationpassword?view=graph-powershell-1.0provider-documentation · last read 2026-09-24 · latest outcome read · supports Cited by the legacy dossier research for this family

Open questions

No open question is recorded for this revision.