Audit Entra ID App Registrations for Expiring Secrets/Certificates and Privileged Permissions

Audit expiring credentials and privileged apps via the Entra admin portal

This GUI-based walkthrough is useful for spot checks or when you need to act on a single finding. For a full tenant audit, the script or API approach is far more efficient.

Part 1 — Find expiring secrets and certificates

1. Sign in to the Microsoft Entra admin center as an account with Application Administrator or Global Reader.
2. Navigate to Identity → Applications → App registrations.
3. Select the All applications tab so you are not limited to apps you own.
4. Click Columns and enable the Certificates & secrets column if available, or review each app individually.
5. For each app, open it and go to Certificates & secrets. Note any Client secrets or Certificates with an Expires date within 30 days.
6. Record the app name, the credential hint/thumbprint, and the expiry date in your tracker.

Part 2 — Find apps with Global Administrator (or other privileged roles)

1. In the Entra admin center, go to Identity → Roles & admins → Roles & admins.
2. Open the Global Administrator role.
3. Review the Assignments tab. Assignments whose Type is Service Principal (not User or Group) are the apps you care about.
4. Click each service principal to open its overview, then go to Sign-in logs (or review the Sign-in activity column) to see when the app last authenticated.
5. Flag any service principal whose last sign-in is older than 90 days, or which has never signed in.
6. Repeat for other high-privilege roles you care about: Privileged Role Administrator, Application Administrator, Cloud Application Administrator, Privileged Authentication Administrator, User Administrator, Exchange Administrator, SharePoint Administrator.

Part 3 — Triage findings

• For expiring credentials: contact the app owner and coordinate a rotation before the expiry date.
• For inactive privileged apps: confirm with the owner whether the role is still required; if not, remove the role assignment or delete the app.

Audit via Microsoft Graph

The audit requires cross-referencing three Graph collections: applications (for credentials), servicePrincipals (for sign-in activity), and roleManagement/directory/roleAssignments (for privileged role holders).

Step 1 — List all app registrations with credentials

GET https://graph.microsoft.com/v1.0/applications?$select=id,displayName,appId,passwordCredentials,keyCredentials&$top=999

Follow @odata.nextLink until all pages are consumed. Each app's passwordCredentials[] and keyCredentials[] contain an endDateTime field in ISO 8601 format.

Step 2 — Enumerate Global Administrator assignments

Global Administrator has the well-known template ID 62e90394-69f5-4237-9190-012177145e10:

GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?$filter=roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'

Each result contains a principalId. Collect them into a set; any service principal whose id is in that set has Global Administrator.

Step 3 — Fetch service principals with sign-in activity

GET https://graph.microsoft.com/beta/servicePrincipals?$select=id,appId,displayName,signInActivity

signInActivity.lastSignInDateTime is only populated when the app has signed in during the audit log retention window and requires AuditLog.Read.All plus Entra ID P1/P2.

Step 4 — Correlate and report

Build a dictionary of service principals keyed by appId. For each application:

• Walk passwordCredentials and keyCredentials; report any whose endDateTime is within the next 30 days and still in the future.
• Look up the matching service principal and check whether its id is in the Global Admin set. If so, evaluate signInActivity.lastSignInDateTime; flag if older than 90 days or absent.

Example finding shape

{
  "expiringSoon": [
    { "appName": "veeambackup", "type": "Secret", "expiry": "2026-03-19T00:00:00Z" }
  ],
  "flaggedPrivilegedApps": [
    { "appName": "Legacy Provisioning Tool", "role": "Global Administrator", "lastSignIn": "2024-08-02T11:14:00Z" }
  ]
}

Audit via Microsoft Graph PowerShell

The script below uses the Microsoft.Graph PowerShell SDK to run the complete audit and emit a CSV report. Install the modules once with:

Install-Module Microsoft.Graph.Applications,Microsoft.Graph.Identity.DirectoryManagement,Microsoft.Graph.Identity.SignIns -Scope CurrentUser

Then authenticate with the required scopes:

Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All","RoleManagement.Read.Directory","AuditLog.Read.All"

The script will:

1. Page through every app registration and check both PasswordCredentials and KeyCredentials for expiry within the configurable window (default 30 days).
2. Enumerate role assignments for a configurable set of privileged directory roles (default: Global Administrator).
3. Pull signInActivity from the beta service principal endpoint and flag any privileged app inactive beyond the configured threshold (default 90 days).
4. Write two CSV files and print a summary to the console.

Run it on a schedule (Azure Automation, Task Scheduler, or a pipeline) and feed the CSVs into your ticket system or a Teams webhook for follow-up.