Monitor Azure keyvault Key\Secret\Certificate Expiry

@PrashanthMiryala-9639

Thank you for your post and I apologize for the delayed response!

I understand that you're trying to create alerts based off a Certificate's expiration date without having to use any automation such as a runbook, webhook, etc. To hopefully help point you in the right direction or resolve your issue, I'll share my findings below.

Findings:

You can automate alerts without the need for additional automation resources (i.e. runbook/webhook) by adding certificate contact(s) to your Key Vault and configuring notifications for certificate life events.

• Note: The contact's information is shared by all the certificates in the key vault and a notification is sent to all the specified contacts for an event for any certificate in the key vault.

Get notified about certificate expiration:

• Note: For existing Certificates, you'll need to manually update the Issuance Policy from Automatic to Email.

If a certificate's policy is set to auto renewal, then a notification is sent on the following events:

• Before certificate renewal
• After certificate renewal, stating if the certificate was successfully renewed, or if there was an error, requiring manual renewal of the certificate.

When a certificate policy is set to be manually renewed (email only), a notification is sent when it's time to renew the certificate.

Additional Links:

• Renew your Azure Key Vault certificates
• Configure Azure Key Vault alerts - Action Groups
• Use Logic Apps to receive email about status changes of key vault secrets
• Receive and respond to key vault notifications with Azure Event Grid

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Hi Prashanth,

Take a look at this post, it mentions there are already built in methods for notification of expired keys.

https://techcommunity.microsoft.com/t5/azure-infrastructure/keyvault-expiry-date-notification-automation/m-p/3662356

Regards,

Hi Team,
What is the privilege's required to create logic app in azure ?
Iam getting error while creating connection with my id

Certificates have an issuance policy, but secrets have not. If you want this on secrets, this blog post can work for it. I have not tried this from end to end, but I succeeded in query SecretNearExpiry operation in the log analytics workspace. This is promising: https://medium.com/version-1/azure-key-vault-secret-expiry-notifications-using-azure-alerts-e6930d3f135d