Azure Service principal

1. The presence of passwordCredentials on a service principal confirms that password-based credentials (client secrets) are configured for that service principal. The actual secret values are never exposed via Microsoft Graph; only metadata such as displayName, keyId, and validity period is returned. The security concern is not that the secret is visible in clear text (it is not), but that any valid, unexpired client secret can be used to authenticate as this service principal wherever it is configured (code, scripts, pipelines, etc.).
2. Multiple entries in passwordCredentials are normal. Common reasons:
   • Credential rollover (old and new secrets co-exist for a period).
   • Different apps/scripts using different secrets.
   Expired secrets remaining in the list are not an immediate security risk because they can no longer be used to authenticate. However, leaving unused or expired credentials in place is not recommended; Entra recommendations explicitly advise removing unused credentials from apps and service principals.
3. Removing a secret will immediately break any application, script, or automation that still uses that specific client secret. Before removing a credential:
   • Identify where that keyId/secret is used.
   • Add and deploy a replacement credential (new secret or certificate) to all dependent workloads.
   • After confirming they work with the new credential, remove the old one.
4. Yes, the documented method to remove a password credential from a service principal is:

      POST https://graph.microsoft.com/v1.0/servicePrincipals/{id}/removePassword
   

   with a body containing the keyId of the password credential to remove, for example:

      {
        "keyId": "b1d4c2f8-6e39-4c12-a7a2-5f83d2e4c901"
      }
   

   The API supports addressing the service principal by id or by appId.
5. Yes. removePassword removes a single password credential per call. If three keyId values are listed and all three should be deleted, call removePassword once for each keyId to be removed.
6. In Graph Explorer, the key requirements are:
   • HTTP method: POST.
   • URL: /v1.0/servicePrincipals/{id}/removePassword (or by appId).
   • Headers:
     • Authorization: Bearer {token} – Graph Explorer sets this automatically after sign-in.
     • Content-Type: application/json.
   The calling identity must have one of the required permissions, such as Application.ReadWrite.All, Directory.ReadWrite.All, or Application.ReadWrite.OwnedBy, and an appropriate Entra role (for example, Application Administrator, Cloud Application Administrator, or owner of the application). No additional custom headers are required beyond standard Graph auth and content-type headers.

For better security, consider migrating from client secrets to certificate-based authentication and storing credentials in Azure Key Vault.

References:

• Securing service principals in Microsoft Entra ID
• Microsoft Entra recommendation: Remove unused credentials from apps (preview)
• Microsoft Entra recommendation: Renew expiring service principal credentials (preview)
• servicePrincipal: removePassword
• Compromised and malicious applications investigation
• Secure your Azure Key Vault secrets