Static API key/credential in continuous use for extended period without rotation

Duo Tech@duotech

•updated Aug 6, 2026•3•0•8

Identifies Azure AD service principal credentials (KeyId) that have been continuously used for 90 or more days without rotation, surfacing long-lived static API keys/credentials that increase exposure risk to token jacking, credential theft, or gray-market resale of AI/API access.