Production Billing Service
ATC-MID-0001188 · Microsoft Entra ID
81
high risk
Ownership
Why it exists, and who answers for it
- Purpose
- Reconciles invoices and posts settlement records to the finance ledger.
- Business owner
- Marit Halvorsen · Finance Operations
- Technical owner
- Unassigned
- Type
- Service principal — An application instance inside the identity provider.
- Environment
- production
- Last authenticated
- 1 minute ago
The chain
From a person to a resource
Every link is a place a question stops being answerable if nobody recorded it.
- Human ownerMarit Halvorsen · Finance Operations
- AI agentAccounts Payable Agent
- Machine identityProduction Billing Service
- CredentialAPI key, Client secret
- ResourcesBilling API, Microsoft Graph, AWS · account 4471, PostgreSQL · finance
Risk
Why the score is 81
- +20
Credential
Long-lived API key with no expiry set
- +18
Privilege
Administrative permission on Microsoft Graph
- +14
Resource
Reaches the financial system directly
- +12
Credential
Client secret last rotated 392 days ago
- +9
Cross-account
Can assume a role in a second AWS account
- +8
Compliance
No access review on record
- 81Total
Credentials
What it authenticates with
- API keylong-livedBearer secret
Billing API · full
- Last rotated
- Never since issue
- Last used
- 1 minute ago
- Expires
- Never
- Client secretlong-livedBearer secret
Microsoft Graph · application
- Last rotated
- 392 days ago
- Last used
- 2 hours ago
- Expires
- in 41 days
Effective access
What it can do, against what it has done
Effective permissions, not assigned roles — a role, a group and a resource policy combine into reach that no single screen in the source system shows. 115 of 132 granted actions were not used in the last 90 days.
- Billing APIFinancial
held via Direct role
34 actions granted, 9 used. 25 could be removed on the evidence.
- Microsoft GraphAdministrative
held via Group membership
61 actions granted, 4 used. 57 could be removed on the evidence.
- AWS · account 4471Write
held via Cross-account trust
37 actions granted, 4 used. 33 could be removed on the evidence.
Blast radius
What a compromise of this credential reaches
1 agent stops working the moment this identity is quarantined — which is exactly what an operator needs to know before doing it.