Short answer: Microsoft Entra ID has no built-in expiry email for app registration secrets and certificates like the SAML certificate emails at 60, 30 and 7 days. It lists credentials expiring within 30 days as a recommendation. A preview email goes to users with the Application Administrator role when that recommendation is new, not to app owners.
What Microsoft Entra sends
Microsoft Entra has several expiry signals. Only the SAML certificate emails are scheduled per certificate. Compare coverage and recipients before you rely on one.
| Mechanism | What it covers | Who gets it | How often | Source |
| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| "Renew expiring application credentials", preview | App registration secrets and certificates expiring within 30 days. API name is applicationCredentialExpiry. | No email of its own. Users with read access see it in the admin center or Graph beta. | Listed while a credential is within 30 days of expiry. | Application credential recommendation |
| "Renew expiring service principal credentials", preview | Service principal credentials expiring within 30 days, including the SAML certificate renewal path. API name is servicePrincipalKeyExpiry. | No email of its own. Users with read access see it in the admin center. | Listed while a credential is within 30 days of expiry. | Service principal recommendation |
| Recommendation emails, preview | New recommendations, including both credential recommendations above. | Users with the Application Administrator role, for both recommendations above. | When a new recommendation is generated. | Recommendation email behavior |
| SAML signing certificate expiry emails | SAML signing certificates. | Up to five configured addresses. Sender is azure-noreply@microsoft.com. | 60, 30 and 7 days before expiry. | SAML certificate email settings |
| Key Vault Event Grid SecretNearExpiry | A copy of a secret stored in Key Vault with an expiry date. | Your subscribed event handler. | 30 days before the Key Vault expiry. | Key Vault events |
Recommendation emails are on by default. A Security Administrator can disable them at Entra ID > Overview > Recommendations > Email settings. See Microsoft's email configuration guide.
With Privileged Identity Management, recipients must have activated the target role. If nobody holds it actively, Microsoft sends no email. See the preview email rules.
Key Vault watches the stored copy, not the app registration. Keep that copy's expiry aligned with the credential you want to monitor. Microsoft requires an event subscription and notes that notification events apply only to new versions. See the Key Vault Event Grid overview.
For SAML renewal steps and notification details, use the SAML signing certificate guide.
Who receives the warning
An Application Administrator is not necessarily the app owner. Microsoft's role reference says users in that role are not added as owners of applications they create. The recommendation email target is the role holder.
Keep the person responsible for renewal in your own routing plan. If an app has no reachable owner, follow Ownerless credential or Owner left, credential still active.
Check the recommendation yourself
Open Entra ID > Overview > Recommendations in the Microsoft Entra admin center. Select "Renew expiring application credentials", then review Impacted resources. Microsoft documents this path in the recommendation action plan.
Reports Reader, Security Reader and Global Reader provide read-only access. For Graph, the read permission is DirectoryRecommendations.Read.All. The same recommendation guide provides this beta request template:
GET https://graph.microsoft.com/beta/directory/recommendations/<directory-id>_ApplicationCredentialExpiry
Replace <directory-id> with your organization's directory ID. The guide's sample response lists requiredLicenses as microsoftEntraWorkloadId. Microsoft says license requirements for preview recommendations can change. Check the current requirements before making a licensing decision.
When the built-in warnings are not enough
The email trigger is a new recommendation. Do not treat it as a recurring email for each credential. Its role-based routing may also miss the person who deploys the replacement.
The application recommendation uses a 30-day window. Your approvals and deployment schedule may need more time. Work backward from the expiry using lead time and business-day math.
The email configuration guide describes a summary and links. It does not describe a per-credential record of who was warned. Keep your own notification evidence if you need that record.
Build your own schedule
Microsoft publishes a PowerShell export sample for app registrations with secrets and certificates expiring within a chosen number of days. It includes owners and exports CSV. You maintain the schedule and delivery step. Follow Monitor Entra app credential expiration for the inventory, scheduling and Azure Monitor alert setup.
Where AppAlert fits
AppAlert monitors client secrets, application certificates, SAML signing certificates and Application Proxy SSL certificates for expiry. Its email alerts go to configured admin recipients. Optional owner routing uses owner addresses from the synced inventory and falls back to admin recipients. Set days-before-expiry thresholds per credential type in Organization Settings.
Notification Audit records each attempt and keeps records for 365 days. "Sent" means the provider accepted the message.
Compare Microsoft's built-in warnings, a DIY monitor and AppAlert side by side.
Related links
- Microsoft's application credential recommendation
- Microsoft's recommendation email settings
- Microsoft's SAML certificate guidance
- Build a scheduled credential expiry check
- Client secret expired
- Client authentication certificate expired
- Renewal guides
AppAlert reads credential metadata. It never receives raw secret values or private keys.