Azure Enterprise App/App Registration tracking

Still a real problem in 2026, so adding an updated approach. (If you just want the fastest path and don't need to run anything yourself, there's a hosted option at the very end — scroll down.)

A couple of things worth adding to what's already here. The Get-AzureADApplication snippet won't run anymore (it was retired in 2025), so it's Microsoft Graph now. And another gap, suggested solutions monitor only secrets, but we'd like to monitor certificates as well.

Here's a current version that covers both. It runs in an Azure Automation runbook on a managed identity, so there's no stored secret that expires on you, and it POSTs the result to a webhook so you can send it wherever you want - Slack, Teams, you monitoring tool.

$select = 'id,displayName,appId,passwordCredentials,keyCredentials'
$apps = Get-GraphAll ('https://graph.microsoft.com/v1.0/applications?$select=' + $select + '&$top=999')
$sps  = Get-GraphAll ('https://graph.microsoft.com/v1.0/servicePrincipals?$select=' + $select + '&$top=999')
if ($sps.Count -eq 0) { throw 'No service principals returned. Check the Application.Read.All assignment.' }

$now = [DateTime]::UtcNow
$cutoff = $now.AddDays(30)
$results = @()

function Get-ExpiringCreds {
    param($List, [string]$ObjectType)
    foreach ($o in $List) {
        foreach ($pair in @(@('Secret', $o.passwordCredentials), @('Certificate', $o.keyCredentials))) {
            foreach ($c in $pair[1]) {
                if (-not $c.endDateTime) { continue }
                $end = ([DateTimeOffset]$c.endDateTime).UtcDateTime
                if ($end -ge $cutoff) { continue }
                $script:results += [pscustomobject]@{
                    objectType     = $ObjectType
                    displayName    = $o.displayName
                    appId          = $o.appId
                    credentialType = $pair[0]
                    credentialName = $c.displayName
                    expiresOn      = $end.ToString('yyyy-MM-ddTHH:mm:ssZ')
                    daysLeft       = [math]::Floor(($end - $now).TotalDays)
                    status         = if ($end -lt $now) { 'Expired' } else { 'Expiring' }
                }
            }
        }
    }
}

Find the full script and setup guide, that works in 2026 in this gist.

Step by step:

1. Create an automation account in Azure, create a runbook, use runtime 7.2, system assigned identity.
2. Grant Application.Read.All as a Graph app role (you'll need to use cloud shell, see New-MgServicePrincipalAppRoleAssignment)
3. Put the code above in the runbook, publish.
4. Create a Schedule, assign to a runbook.
5. Run the runbook via the Test Pane to confirm it works.

The script is the easy part tbh. What builds up over time is the receiving end: the same credential shows up every night for a month, so you end up wanting dedupe on appId + credentialName, updating an existing ticket instead of opening a new one, and closing it once the credential stops appearing.

That maintenance is basically why I ended up building a hosted version - AZ Token Watch. Same read-only Application.Read.All, covers app registrations and enterprise apps, sends to email/Slack/Teams/webhook.

Two things it saves you: it can route each alert to the app's owner instead of one shared channel, and keeping up with Graph changes is on me, that surface has shifted a lot lately (AzureAD module retiring, old Teams webhooks going away, SMTP auth changes), and self-hosted scripts tend to break quietly when it does. Free tier, and setup is a few minutes since it's admin-consent, not a runbook to deploy. The script above is the better call if you'd rather own it end to end.

Entra doesn't email app owners when an app registration secret or certificate is about to expire. You only get a recommendation in the portal once a credential is within 30 days of expiry.

The DIY route is a scheduled script that reads passwordCredentials and keyCredentials via Graph and alerts on endDateTime. Microsoft has a sample here: learn.microsoft.com/en-us/entra/identity/enterprise-apps/scripts/powershell-export-apps-with-expiring-secrets

If you'd rather not maintain that, I build AppAlert (appalert.online), which connects read-only and emails admins before secrets and certificates expire. Free during Early Access.

Hi @Pawlak, Owen - (BOS)

Thank you for posting this in Microsoft Q&A.

I understand that you are looking for an effective method to monitor Enterprise Apps and App Registrations, particularly to track the expiration of App certificates and secrets.

You can utilize PowerShell or Power Automate to set up notifications for expiring secrets or certificates.

1.Export all of your app registrations or Enterprise applications with secrets and certificates via PowerShell script.

2.You can use Power Automate to notify of upcoming client secret expiration, as detailed in this article

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/use-power-automate-to-notify-of-upcoming-azure-ad-app-client/ba-p/2406145

3.Alternatively, you can use a logic app that runs daily. Here is a Logic Apps example: https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/use-azure-logic-apps-to-notify-of-pending-aad-application-client/ba-p/3014603?fbclid=IwAR3ECopMRsitagEStKLC_yvAmFX4a1Ispn_a8ZFitapPquq9OZcZvQgKVOQ

4.Another option would be to use an Azure Automation account to send logs to a Log Analytics workspace. Then you could set up Azure Monitor alerts to run queries for expiration warnings and errors.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Hello Pawlak, Owen - (BOS),

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are looking for an efficient way of tracking Enterprise Apps and App Registrations. Specifically, tracking when App certificates or secrets expire.

Keeping track of the expiration dates for app certificates and secrets in Azure is an important aspect when it comes to ensuring your enterprise applications stay secure and running, but you cannot really achieve this either inside or outside of the portal. Many different ways and tools you can employ to manage your Azure App Registrations as well as how to track certificates, and secrets associated with them:

• Azure AD Access Reviews and Conditional Access.
• Certificates and Secrets Management in the Azure portal.
• Azure CLI and PowerShell is my favorite tool by using Azure AD PowerShell modules to automate the tracking process, like this example:

         $apps = Get-AzureADApplication
         foreach ($app in $apps) {
             $secrets = Get-AzureADApplicationPasswordCredential -ObjectId $app.ObjectId
             foreach ($secret in $secrets) {
                 if ($secret.EndDate -lt (Get-Date).AddDays(30)) {
                     Write-Output "$($app.DisplayName) secret expires on $($secret.EndDate)"
                 }
             }
         }
  

• Set up alerts in Azure Monitor to notify you when a certificate or secret is nearing its expiration.
• Using custom Azure Policies to audit the expiration dates of certificates and secrets.
• You can create a custom solution using Azure Functions or Logic Apps to periodically check the expiration dates of certificates and secrets and send notifications or create tickets for remediation like other enterprises.
• I have seen a friend using third-party tools like CloudBolt, AppDynamics, or CloudHealth.

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

Best Regards,

Sina Salam