Risk Automations: Configure the ‘Reset Exposed Credentials’ Template

• Overview
• Step 1: Copy the OAuth redirect URL
• Step 2: Create an Entra app registration
• Step 3: Assign permissions
• Step 4: Add the redirect URI
• Step 5: Generate a client secret
• Step 6: Add the Microsoft Entra ID credential
• Step 7: Add the Microsoft Teams Account credential
• Replace the client secret before it expires

Overview

The Reset exposed credentials template resets the credentials of users involved in an identity breach and messages the affected users. For Microsoft Entra ID and Microsoft Teams, it uses one Entra app registration for two credentials in Risk Automations: Microsoft Entra ID and Microsoft Teams Account.

Setup workflow:

• Copy the OAuth redirect URL from Risk Automations.
• Create an Entra app registration with permissions to reset credentials and message users, add the redirect URI, and generate a client secret.
• Enter the app registration’s values into the Microsoft Entra ID and Microsoft Teams Account credentials.

You’ll gather three values from Entra:

• Application (client) ID
• Directory (tenant) ID
• Client secret value

Step 1: Copy the OAuth redirect URL

1. Click the Risk Automations icon in UpGuard’s left-hand navigation panel.
2. Click Credentials.
3. Select Microsoft Teams Account.
4. Copy the OAuth Redirect URL.

Keep the URL handy, because you’ll add it to your Entra app registration in Step 4.

Step 2: Create an Entra app registration

1. Open the Microsoft Entra admin center.
2. Go to Identity > Applications > App registrations.
3. Click New registration.
4. Enter a name (for example, UpGuard-Reset-Exposed-Credentials).
5. For Supported account types, select Single tenant.
6. Click Register.

To learn more, see Microsoft’s guide: Register an application in Microsoft Entra ID.

Step 3: Assign permissions

1. In your app registration, click API permissions.
2. Click Add a permission, then select Microsoft Graph.
3. Select Application permissions.
4. Select each permission in the table below.
5. Click Add permissions.
6. Click Grant admin consent for [your tenant name].
7. Check the Status column and confirm each permission shows Granted.

To learn more, see Microsoft’s guide: Configure app permissions for a web API.

Step 4: Add the redirect URI

1. In your app registration, click Authentication (Preview).
2. Click Add Redirect URI.
3. Select Web.
4. Paste the OAuth redirect URL you copied in Step 1.

Step 5: Generate a client secret

1. In your app registration, click Certificates & secrets, then Client secrets.
2. Click New client secret.
3. Enter a description that includes the expiry date (for example, UpGuard Risk Automations reset credentials, expires [month year]).
4. Select an expiry date.
   • We recommend 12 months, but you can choose a shorter period if your security policy requires it. Entra caps a secret’s lifetime at 24 months.
   • You can’t extend a secret. When it expires, you create a new one.\
   • Add the expiry date to your team’s calendar or ticketing system so you can replace the secret before it expires.
5. Click Add.
6. Copy the secret Value.

To learn more, see Microsoft’s guide: Add and manage application credentials in Microsoft Entra ID.

Step 6: Add the Microsoft Entra ID credential

1. In the Entra admin center, go to your app registration’s Overview page.
2. Copy the Application (client) ID and the Directory (tenant) ID.
3. In UpGuard, navigate to Risk Automations > Credentials.
4. Select Microsoft Entra ID.
5. For Grant Type, select Client Credentials.
6. In Access Token URL, replace “common” with your Directory (tenant) ID.
7. In Client ID, enter your Application (client) ID.
8. In Client Secret, enter the client secret value you copied in Step 5.
9. Save the credential.

Step 7: Add the Microsoft Teams Account credential

Use the same Directory (tenant) ID and Application (client) ID from Step 6, and the same client secret value from Step 5.

1. In UpGuard, navigate to Risk Automations > Credentials.
2. Select Microsoft Teams Account.
3. In Authorization URL, replace “common” with your Directory (tenant) ID.
4. In Access Token URL, replace “common” with your Directory (tenant) ID.
5. In Client ID, enter your Application (client) ID.
6. In Client Secret, enter the client secret value you copied in Step 5.
7. Scroll to the bottom of the modal and click Connect my account.
8. Save the credential.

Both credentials are now saved in Risk Automations. Next: configure, test, and activate your workflow.

Replace the client secret before it expires

Replace the secret before its expiry date so the workflow keeps running.

1. In the Entra admin center, go to your app registration, then Certificates & secrets > Client secrets.
2. Create a new secret and copy its Value.
3. In UpGuard, navigate to Risk Automations > Credentials and open the Microsoft Entra ID credential.
4. Replace the Client Secret with the new value and save.
5. Open the Microsoft Teams Account credential and replace its Client Secret with the new value too.
6. Run the workflow to confirm it still works.
7. Return to Entra and delete the old secret.