Find Entra ID App Registrations With Secrets or Certificates Expiring Soon

Review expiring credentials in the Entra admin center

The portal doesn't have a single tenant-wide expiry report, so this is a per-app inspection workflow — best for small tenants or spot checks. For scale, use the API or PowerShell approach.

1. Sign in to the Microsoft Entra admin center as a Global Reader, Application Administrator, or higher.
2. Navigate to Identity → Applications → App registrations.
3. Select the All applications tab to include apps you don't own.
4. Click the column selector and ensure Certificates & secrets visibility is enabled (or open each app individually).
5. For each app of interest, open it and select Manage → Certificates & secrets.
6. Review the Expires column under both Client secrets and Certificates tabs.
7. Note any credential expiring within your renewal window (typically 7–30 days).
8. Click Owners in the left navigation to identify who to contact for renewal coordination.

Tip: The portal flags credentials expiring within 30 days with a yellow warning banner on the app's Overview page — but you must visit each app to see it.

Query app credentials via Microsoft Graph

Use GET /applications and filter client-side on endDateTime. Graph does not support server-side $filter on passwordCredentials/endDateTime, so you must retrieve and evaluate.

Endpoint

GET https://graph.microsoft.com/v1.0/applications?$select=id,displayName,appId,passwordCredentials,keyCredentials&$top=999

Required header

Authorization: Bearer {access_token}

Sample response (trimmed)

{
  "value": [
    {
      "id": "a1b2c3d4-...",
      "appId": "9f8e7d6c-...",
      "displayName": "Contoso Payroll Integration",
      "passwordCredentials": [
        {
          "displayName": "prod-secret",
          "endDateTime": "2025-02-14T10:00:00Z",
          "keyId": "..."
        }
      ],
      "keyCredentials": []
    }
  ],
  "@odata.nextLink": "https://graph.microsoft.com/v1.0/applications?$skiptoken=..."
}

Client-side filter logic

1. Parse each app's passwordCredentials[].endDateTime and keyCredentials[].endDateTime.
2. Keep only credentials where endDateTime is between now and now + N days.
3. Follow @odata.nextLink until absent — do not stop at the first page.

Renewal workflow

To add a new secret before removing the old one:

POST /v1.0/applications/{id}/addPassword
Content-Type: application/json

{
  "passwordCredential": {
    "displayName": "renewed-2025",
    "endDateTime": "2026-02-01T00:00:00Z"
  }
}

The response contains the secretText — the only time the secret value is ever returned. Capture it securely and share with the app owner via an approved channel.

Audit with PowerShell + Microsoft Graph SDK

The Microsoft.Graph PowerShell module handles pagination automatically via -All and is the easiest way to produce a reusable report.

Prerequisites

• PowerShell 7+
• Microsoft.Graph module: Install-Module Microsoft.Graph -Scope CurrentUser
• Account with Application.Read.All consent

One-liner preview

Connect-MgGraph -Scopes "Application.Read.All"
Get-MgApplication -All -Property Id,DisplayName,AppId,PasswordCredentials,KeyCredentials |
  Where-Object {
    ($_.PasswordCredentials.EndDateTime -lt (Get-Date).AddDays(7)) -or
    ($_.KeyCredentials.EndDateTime     -lt (Get-Date).AddDays(7))
  } |
  Select-Object DisplayName, AppId

The full script below expands this with per-credential detail, CSV export, and configurable window.