Product documentation

Approve read-only Microsoft Graph permissions so AppAlert can run its first credential inventory sync.

AppAlert requests read-only Microsoft Graph permissions and stores credential metadata. It never receives secret values or private keys.

See expired credentials and those expiring within 90 days, grouped by urgency. Each entry links to the matching renewal guide.

Set channels, admin recipients, owner routing, expiry thresholds, the email template, and test sends for Microsoft Entra app credential alerts.

See each credential expiry alert email attempt in Notification Audit. Check what Sent, Failed, Skipped, delivery and bounce outcomes mean.

Find Entra App Proxy SSL certificates that expire soon and replace the PFX on every existing app with the portal or Microsoft's PowerShell script.

Why Azure DevOps pipelines fail with AADSTS7000222 when the service connection client secret expires, how to renew it, and how to stop it happening again.

Entra app certificate expired or failing with AADSTS700027? Find certificates that expire soon and renew with Azure CLI --append or Graph addKey.

Entra client secret expired with AADSTS7000222? Renew it with Azure CLI, PowerShell or Graph without an outage and find secrets that expire soon.

Entra Connect Sync warns with Event ID 1011 at 70% of the certificate's lifetime. What the warning means, how to check the scheduler, how to rotate.

Find Entra apps whose listed owner left or is disabled, assign a successor, then renew the expiring secret or certificate before workloads fail.

Find Entra apps with no owner, see which administrators can renew their secrets or certificates, and follow the renewal path before credentials expire.

Find Entra SAML signing certificates that expire soon, check expiry emails, and renew with Graph or the portal after the application accepts the new key.

Resolve the approval-required state, check an administrator's approval, and separate connection problems from initial inventory sync.

Check initial sync, queue filters, credential coverage, and owner-data freshness before relying on an empty Operations queue.

Check Notification Audit, saved settings and thresholds, skipped or suppressed recipients, and the provider delivery outcome.

How to see which secret or certificate key id an Entra workload still presents, in the portal or with a Log Analytics query, before you remove the old one.

Which expiry emails Microsoft Entra sends for app registration secrets and certificates, who receives them, and how to get a warning on your own schedule.

Build a scheduled check of Entra app registration and service principal secret and certificate expiry dates with Microsoft Graph and Azure Monitor alerts.

Compare a custom credential expiry script with AppAlert for setup, maintenance, coverage, owner routing, notification records and cost.