Expiring Entra app credential after the owner left

What breaks

An Entra app can still look owned after its owner leaves. Its Owners page lists a person who can no longer sign in to renew the credential. Find these apps and assign a successor before the secret or certificate expires. Once it expires, workloads that use it can no longer authenticate with it.

The failure itself works as described in the entries for an expired client secret and an expired client authentication certificate. Microsoft's credential guide explains how a new secret or certificate is added to the app registration.

When the owner is gone, the warning still arrives

AppAlert emails your admins before credentials of disabled or deleted owners expire. Read-only, free during Early Access. Connect read-only

Read-only permissions: Microsoft Graph application permissions Application.Read.All, Directory.Read.All, AgentIdentity.Read.All, AgentIdentityBlueprint.Read.All, AgentIdentityBlueprintPrincipal.Read.All, plus User.Read for sign-in. No write permissions: AppAlert cannot create, rotate, or delete credentials.
Never received: Secret values, certificate private keys, Microsoft account passwords, and mailbox contents. AppAlert stores credential metadata such as type, expiry date, and owner email addresses.
Where data lives: App functions and database in Frankfurt, Germany (Vercel fra1, Neon on AWS eu-central-1). Alert emails are sent through Resend, which stores them in the United States. Data location
Revoke any time: A Microsoft Entra administrator can revoke AppAlert's enterprise application consent. That stops future directory reads; deleting stored data is a separate request. Retention and revocation

How you notice

Before expiry, check one app by reading its owner list with accountEnabled:

GET https://graph.microsoft.com/v1.0/applications/{application-object-id}/owners?$select=id,displayName,userPrincipalName,accountEnabled

List owners of an application supports $select. Ask for accountEnabled by name, because the user resource returns it only when you select it. A value of false means the owner's account is disabled.

The ownerless filter owners/$count eq 0 from Entra app credential expired with no owner misses these apps. A disabled owner still counts as an owner.

To check every app registration, run this loop in Microsoft Graph PowerShell:

Connect-MgGraph -Scopes Application.Read.All,User.Read.All
Get-MgApplication -All -Property id,displayName,appId | ForEach-Object {
  $owners = Get-MgApplicationOwner -ApplicationId $_.Id -All -Property id,userPrincipalName,accountEnabled
  $enabled = $owners | Where-Object { $_.AdditionalProperties.accountEnabled -eq $true }
  if (-not $enabled) {
    [pscustomobject]@{ App = $_.DisplayName; AppId = $_.AppId; ListedOwners = @($owners).Count }
  }
}

It lists apps with no enabled owner, which includes apps with no owner at all. A ListedOwners value above 0 means owners are listed but none of them can sign in. The loop makes one Graph call per app, so it is slow on large directories. User.Read.All is in the scopes because Graph returns only the id and type of directory objects the caller has no permission to read, which would leave accountEnabled empty. A service principal can also be an owner, and the loop counts it as enabled when its own accountEnabled is true, even though no person signs in with it. Check apps whose only enabled owner is a service principal by hand. Enterprise applications have their own owner list. For those, loop over Get-MgServicePrincipal -All and read owners with Get-MgServicePrincipalOwner -ServicePrincipalId.

If you already know the former owner's user object id from an ownership inventory or offboarding record, check whether that user is soft-deleted. Deleting a user in Entra is a soft delete. The account can be restored for up to 30 days and is then permanently deleted, as described in Recover from deletions. List soft-deleted users with GET /directory/deletedItems/microsoft.graph.user, which needs User.Read.All, according to List deleted items, and match the known user object id to an id in the results. Follow any @odata.nextLink to check all pages. This endpoint returns deleted users, not their former application ownership; it cannot tell you which apps a deleted user owned. Keep the user-to-application mapping in the ownership inventory or offboarding record.

Once the account is deleted and no other owner remains, treat the app as ownerless. The ownerless entry has the filter that finds those apps across the directory.

After expiry, authentication fails and the people who run the workload report it. The entries for secrets and certificates list what to check.

Why it happens

Application owners can be users or service principals, as documented in List owners of an application. When a human owner leaves, disabling their account does not transfer ownership to a successor. Microsoft's ownership FAQ answers the question "What should I do with applications where the owner is no longer with the organization?" by treating the app as ownerless. It points to the app's audit log and the Roles and administrators tab to find the right person, whom a highly privileged admin then assigns as the new owner.

Leaver processes skip app ownership. Microsoft's steps to remove a former employee block sign-in, save the mailbox, wipe and block mobile devices, forward email or convert the mailbox to a shared mailbox, give another employee access to OneDrive and Outlook data, remove licenses, and delete the account. None of these steps covers app registration ownership. The same page notes that deleting the account stops mail sent to it from being received.

The Lifecycle Workflows task list has leaver tasks for the account itself, groups, Teams, access packages, licenses, and refresh tokens, plus a task that transfers agent identity sponsorships to the manager. It has no task for app registration or enterprise application ownership. Its "Run a custom task extension" task calls a Logic App, which a team can use to add that step.

Disabling an account blocks that person's sign-in. The secrets and certificates are added to the app registration, not to the owner's account, so the workload keeps using them until they expire. Because the app keeps working after the owner leaves, nobody looks at it until the expiry date.

Renewal path

Confirm the listed owner has left with the manager or offboarding record; a disabled account alone does not prove departure. Check accountEnabled with the request above, or the user's status in the admin center. If a known former owner was deleted, use their user object id from the ownership inventory or offboarding record to check the Deleted users page or match the deletedItems results described above.
Find the successor. The leaver's manager or team usually knows who took over the work. If nobody knows, use the audit log and the Roles and administrators tab as described in Entra app credential expired with no owner, which also covers how far back the audit log goes.
Add at least two new owners in the Entra admin center, or call POST /applications/{id}/owners/$ref. In delegated mode, Add owner requires the Application.ReadWrite.All and Directory.Read.All permissions plus the Hybrid Identity Administrator, Cloud Application Administrator, or Application Administrator role. An existing owner can also add owners, but here the existing owner is the leaver. The request body names the new owner's object id:
```
POST https://graph.microsoft.com/v1.0/applications/{application-object-id}/owners/$ref
Content-Type: application/json

{
  "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/{new-owner-object-id}"
}
```
For enterprise applications, including SAML apps, add owners in the admin center with the steps in Assign enterprise application owners. Microsoft notes that owners added through Graph or PowerShell cannot manage some settings, such as configured SAML certificate properties.
Remove the departed owner, so the list shows who can act:
```
DELETE https://graph.microsoft.com/v1.0/applications/{application-object-id}/owners/{departed-owner-object-id}/$ref
```
Keep /$ref at the end. According to Remove application owner, a call without it also deletes the user from Microsoft Entra ID if the caller has permission to manage that user, and fails with 403 Forbidden otherwise. In delegated mode the call needs Application.ReadWrite.All and one of the same three roles as in step 3.
Set serviceManagementReference on the application to a team contact from your service or asset management database, so the app keeps a contact after the next person leaves. Microsoft recommends this in the same ownership FAQ.
The new owner renews the credential with the matching entry for a client secret, a client authentication certificate, or a SAML signing certificate. Before removing the old credential, check which credential the workload still uses and confirm every consumer has moved.
If the credential will expire before a new owner is found, a user in the Application Administrator or Cloud Application Administrator role can add the new credential, because both roles can manage all app registrations. See the built-in roles reference. Treat that as outage prevention, not the normal path. Do not re-enable or restore the leaver's account to do the renewal.

Who should own it

Name two application owners from the team that runs the workload, and record a team contact in serviceManagementReference. Microsoft recommends at least two owners where possible. Groups cannot be owners of enterprise applications, so a group cannot stand in for a person. See enterprise application ownership.

The identity team owns the leaver step. Before an owner's last day, list the apps they own and move ownership. In the admin center, open Enterprise applications, then All applications, and use Add filter with "owned by" to find the apps a person owns.

Lead time and business-day math

Suggested planning buffer: 30 calendar days, the same as the core entries.

For this failure mode, the clock starts at the leaver date, not at the expiry date. Move ownership before the last day, while the leaver can still hand over. Lifecycle Workflows has a "Send email to manager before user's last day" task, and its email text can be customized to carry that reminder. See the Lifecycle Workflows task list.

If the account is deleted and the app becomes ownerless, the audit log may reach back only 7 or 30 days. The ownerless entry covers retention. Then subtract weekends, holidays, approval time, and deployment freezes when scheduling the change.

If the owner list is empty, see Entra app credential expired with no owner.

The credential fails the same way as in the entries for an expired client secret, an expired client authentication certificate, and an expired SAML signing certificate. For SAML, remember that enterprise application owners are a separate list from app registration owners.

"Old credential removed too early" is planned as a separate entry.

Monitored by AppAlert

Monitored

AppAlert reads each owner's accountEnabled during owner sync and drops owners whose account is disabled from the owner list. If every owner of an app is disabled, AppAlert treats its credentials as ownerless and sends expiry alerts to your admin fallback recipients. A temporarily disabled account, for example after a block or during a leave of absence, also counts as no owner.

Deleted owners drop out through the delta sync, which runs about every 30 minutes. If an owner's email bounces, AppAlert catches that too and routes the alert to the fallback recipients. Configure those recipients in Alert settings and recipients; for a missing alert, follow Missing notifications.