Operations lists expired credentials and those expiring within 90 days in five urgency groups that don't overlap: expired, expiring today, and expiring within 7, 30, or 90 days. Each entry shows the application, available owner information, and expiry, and links to the matching renewal guide. AppAlert reads metadata only and does not rotate credentials.
Before you start
Connect your organization and let the initial sync finish. Operations is the urgent credential queue. Configure notification policy in Organization Settings. Use Agents > Inventory for Agent Identities.
Read the overview
Next expiry shows how many days remain on the most urgent credential, or how long it has been expired. The runway below it places queued credentials on a timeline from 30 days ago to 90 days ahead. The runway counts include every tracked credential. A note shows how many are not drawn on the timeline. Next expiry and the runway reflect your whole organization, even when you filter the queue to admin fallback. The status panel shows current alert routing, inventory freshness, and the five most recent notification attempts.
Read the action queue
Open Operations and find Action queue. Credentials appear in one urgency group: Expired, Expiring today, Expiring within 7 days, Expiring within 30 days, or Expiring within 90 days. The groups do not overlap. For example, the 30-day group contains credentials with 8 to 30 days remaining.
Use the credential-type filters to narrow the list. Each entry shows the credential name and type, application context, available owner information, and expiry. No owners means the current inventory has no owner addresses for that entry. It does not establish who is responsible for the application.
The queue's urgency groups are separate from your notification thresholds. A credential can appear here without a notification being due today.
Act on a credential
- Check the application context and expiry on the entry. Open the application details if you need more inventory context.
- Choose Renewal guide for the matching credential procedure. AppAlert uses an application-specific guide when it recognizes a supported application. Otherwise, it uses a credential-type guide.
- Coordinate the change with the application's operator. Follow the guide to replace the credential in Microsoft Entra and update the system that uses it.
- Verify the application's authentication or publishing behavior, then confirm the updated expiry after AppAlert syncs again.
AppAlert reads credential metadata only. It does not rotate credentials or deploy a replacement to your application. Microsoft's application credential instructions explain the underlying registration settings. Use the relevant renewal guide for the complete procedure and coverage limits.
Understand an empty queue
No credentials tracked yet means there are no tracked credentials in this view. Initial sync may still be pending. Follow Missing or stale inventory before concluding that the organization has no expiring credentials.
An all-clear queue with tracked credentials means none are expired or expiring within 90 days. A filtered empty queue applies only to the selected filter. Clear the type filter or use Clear routing filter when reviewing the whole queue.
Review notification routing
Use the admin-fallback view to find credentials whose owner routing would fall back to administrators. It also includes credentials with no administrator fallback because no administrator recipients are configured. It does not enable owner notifications. Review owner routing and saved recipients in Organization Settings. Check notification history for recorded attempts. An entry in the queue does not mean an email was sent.