Automate sending email notifications for client secret expiration of App Registration under Microsoft Entra ID

Question

Is there any way to set up email notifications or alerts for the expiration of any client secret in an app registration on Microsoft Entra ID ?

Answer 1

@Sachin Gupta

Thank you for your post and I apologize for the delayed response!

Unfortunately, there isn't a direct way within the Portal to set up notifications or alerts for expiring secrets within an App Registration. However, you should be able to leverage PowerShell or Microsoft Graph to achieve some form of notification for expiring secrets/ certificates, for example:

1. Export all of your app registrations with expiring secrets and certificates via PowerShell script.
2. Integrate the PowerShell script into an Azure Logic App or Task Scheduler.
3. Send email notifications via the Logic App or Task Scheduler with the PowerShell output.

Additional Links:

• Export app registrations with expiring secrets and certificates
• Use Power Automate to Notify of Upcoming Azure AD App Client Secrets and Certificate Expirations
• Microsoft Entra recommendation: Renew expiring application credentials (preview)
• What are Microsoft Entra recommendations?
• AUTOMATED ALERTS ON AZURE (ENTRA ID) APPLICATION SECRET EXPIRATIONS - 3rd party documentation
• How can I automate the certificates expiration notifications? - Enterprise Applications

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 2

You can use the Get-AzureADApplicationPasswordCredential cmtlet to get the credentials EndDate. Use the Send-MailMessage cmdlet to send the email. Run the script every day/week/month (or whatever you think is appropriate).

Answer 3

Take a look at this: Recommendation to renew expiring application credentials - Microsoft Entra ID | Microsoft Learn

I had an email a few weeks ago telling me that I had an application credential expiring. When you click the link in the email it takes you to a page on the Azure portal which lists the resource name and ID.

For info I've got E5 licences.

Answer 4

Apparently, an E3 license isn't good enough to access the "recommendation to renew expiring application credentials".

Answer 5

you may consider creating an account automation on Azure with a PowerShell script and scheduling it to receive email notifications

Here is the step-by-step guide

https://wiseservices.co.uk/post/a3a10db6-02b5-4162-9773-cc3e2c618a47