Service disruptions
Expired certificates turn routine rotations into authentication failures, broken automations, and avoidable outages.
For in-house IAM teams
Find the Entra credential that will expire next.
AppAlert gives your team one queue for expiring application secrets, certificates, SAML certificates, and Application Proxy SSL certificates. It warns admins by email and records each send attempt.
Sign in with Microsoft → an admin approves read-only access → the first inventory sync starts
- Microsoft consent
- Read-only
- Never raw secret values
- Metadata
- One linked Entra organization
- Org-scoped
The problem
A credential inventory is not a work queue.
Exports and scripts can list expiry dates. They rarely show the deadline, owner context, and notification history together.
Security shortcuts
Manual fire drills create rushed renewals, weak documentation, and unclear ownership when the deadline is already here.
Operational drag
Identity teams lose hours stitching together scripts, inbox rules, and spreadsheets just to maintain basic visibility.
Features
Three questions, answered in the same queue.
AppAlert keeps the deadline, the owner, and the delivery record beside each credential, so renewal work starts from one screen instead of an export, a spreadsheet, and an inbox.
Priority
What can break next?
Secrets and certificates of all four types are ordered by expiry in one organization-scoped queue, so the next deadline does not hide in a full inventory export.
Ownership
Who needs to act?
Application owners stay beside the credential instead of in a separate spreadsheet. Organization Settings sets admin recipients, alert thresholds, and optional owner routing.
Delivery
Was anyone warned?
Admins get email before expiry. The notification log records sent, skipped, and failed deliveries for each alert run.
Want the detail? Review feature coverage.
See which credentials expire next.
Connect read-only- Read-only permissions
- Microsoft Graph application permissions
Application.Read.All,Directory.Read.All,AgentIdentity.Read.All,AgentIdentityBlueprint.Read.All,AgentIdentityBlueprintPrincipal.Read.All, plusUser.Readfor sign-in. No write permissions: AppAlert cannot create, rotate, or delete credentials. - Never received
- Secret values, certificate private keys, Microsoft account passwords, and mailbox contents. AppAlert stores credential metadata such as type, expiry date, and owner email addresses.
- Where data lives
- App functions and database in Frankfurt, Germany (Vercel fra1, Neon on AWS eu-central-1). Alert emails are sent through Resend, which stores them in the United States. Data location
- Revoke any time
- A Microsoft Entra administrator can revoke AppAlert's enterprise application consent. That stops future directory reads; deleting stored data is a separate request. Retention and revocation
How it works
Connect, set policy, work the queue.
Start with admin recipients. Add owner routing when your team is ready to use it.
Connect your organization
Sign in with Microsoft and have an Entra admin approve access. AppAlert then syncs your applications and their credential expiry dates.
Set notification policy
Choose admin recipients and thresholds first, then expand routing only when your operating model is ready for it.
Work the queue
Renew in expiry order and follow the renewal guide for each credential type.
PricingFree during Early Access · then an intended $200/month per organization, unlimited apps
Billing is not available yet. We will give you 30 days' notice before anything changes.
See what expires next.
Connect one Microsoft Entra organization and review the expiry queue with your own credential metadata.