Automate sending email notifications for client secret expiration of App Registration under Microsoft Entra ID

$@chin 380

Is there any way to set up email notifications or alerts for the expiration of any client secret in an app registration on Microsoft Entra ID ?

Moritz 105 Reputation points

2024-05-02T10:56:38.5233333+00:00

Something like this feels like a basic function for an authentication system that is based on expiring tokens/certificates. Really disappointing that we need to build our own solution for that.
Anonymous

2024-05-24T05:44:00.6966667+00:00

I also ran into this and was googling for a notification solution and then read this item.

Indeed very disappointing. It's actually unbelievable.
Anonymous

2024-05-31T13:11:07.1133333+00:00

Agree with the above, mental that there isnt an alert you can configure...
Ravi Ranjan Kumar 0 Reputation points

2025-02-13T15:34:27.3033333+00:00

Is there any way to setup notification alert on expiration of certificate in azure key vault, if yes please let me know
Oguz Kaan Akyalcin 11 Reputation points

2025-04-04T13:02:30.64+00:00

https://wiseservices.co.uk/post/a3a10db6-02b5-4162-9773-cc3e2c618a47

you can find a way in the article using Azure Automation and PowerShell

7 answers

code-vj 95 Reputation points

2026-08-03T08:11:56.64+00:00

Microsoft Entra ID does not currently offer built-in email notifications for application client secret expiration. Most organizations implement this using Microsoft Graph, PowerShell, Azure Automation, or Logic Apps.

If you are looking for an implementation approach, this guide walks through one option for monitoring Entra ID client secret expiration and sending notifications:

https://ssojet.com/docs/en/references/entra-id-secret-expiration-monitoring
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Rich Matheisen 48,116 Reputation points

2023-12-19T15:47:27.44+00:00

You can use the Get-AzureADApplicationPasswordCredential cmtlet to get the credentials EndDate. Use the Send-MailMessage cmdlet to send the email. Run the script every day/week/month (or whatever you think is appropriate).
Was this answer helpful?
Ralf Oltmanns 5 Reputation points

2024-07-09T15:46:11.4666667+00:00

We check hundreds of certificates regularly with a simple oneliner.

I wonder if there's some smart Entra ID endpoint URL that could simply be queried like this:

openssl s_client -showcerts -servername EntraID_Endpoint_URL -connect EntraID_Endpoint_URL:$TCP_port </dev/null

It's child's play to grep the expiry date from the reponse and would make monitoring that cert a piece of cake.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Automate sending email notifications for client secret expiration of App Registration under Microsoft Entra ID

7 answers

Your answer