How can I tell when a Azure AD client secret expires?

Question

I have many applications registered in Azure AD Tenant and many of these are having client secret keys issued for 1 or 2 years. Is there a way to get an alert before the expiry as expired keys will cause an outage.

user_12491237 · Answer

You can use Logic App to automate the process. I found this useful:

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/use-azure-logic-apps-to-notify-of-pending-aad-application-client/ba-p/3014603?fbclid=IwAR3ECopMRsitagEStKLC_yvAmFX4a1Ispn_a8ZFitapPquq9OZcZvQgKVOQ

user_1505244 · Answer

I created a "simple" one-line Azure Powershell command to show all principals that have or will expire in the next 30 days. Using that as a data feed for an email (like Send-MailMessage) or other alerting tool may be fairly straight forward.

Get-AzureADApplication -All:$true | Select-Object AppId, displayName -ExpandProperty PasswordCredentials | Where-Object EndDate -lt (Get-Date).AddDays(30) | Sort-Object EndDate | Format-Table AppId, DisplayName, EndDate

Note: If you have multiple secrets on a principal, each one shows up as its own line in the output. If you want to see all your principals and their secret expirations, just remove the Where-Object clause in the middle.

How can I tell when a Azure AD client secret expires?

4 Answers