Expiring Entra app credential with no owner

What breaks

A secret or certificate on an Entra app with no owner still needs to be renewed before it expires. An Application Administrator or Cloud Application Administrator can add the new credential. Assign two owners so someone is responsible for the next renewal.

After expiry, workloads using the credential can no longer authenticate with it. See the entries for an expired client secret and an expired client authentication certificate. Microsoft's credential guide explains how to add a new secret or certificate to the app registration.

Find expiring credentials nobody owns

AppAlert flags credentials with no owner and emails your admins before they expire. Read-only, free during Early Access. Connect read-only

Read-only permissions: Microsoft Graph application permissions Application.Read.All, Directory.Read.All, AgentIdentity.Read.All, AgentIdentityBlueprint.Read.All, AgentIdentityBlueprintPrincipal.Read.All, plus User.Read for sign-in. No write permissions: AppAlert cannot create, rotate, or delete credentials.
Never received: Secret values, certificate private keys, Microsoft account passwords, and mailbox contents. AppAlert stores credential metadata such as type, expiry date, and owner email addresses.
Where data lives: App functions and database in Frankfurt, Germany (Vercel fra1, Neon on AWS eu-central-1). Alert emails are sent through Resend, which stores them in the United States. Data location
Revoke any time: A Microsoft Entra administrator can revoke AppAlert's enterprise application consent. That stops future directory reads; deleting stored data is a separate request. Retention and revocation

How you notice

Check the app registration's Owners page before expiry. To find registrations with no owners, filter on the owner count in Microsoft Graph:

GET https://graph.microsoft.com/v1.0/applications?$filter=owners/$count eq 0&$count=true&$select=id,displayName,appId
ConsistencyLevel: eventual

The same query in Microsoft Graph PowerShell:

Connect-MgGraph -Scopes Application.Read.All
Get-MgApplication -Filter "owners/`$count eq 0" -CountVariable CountVar -ConsistencyLevel eventual -All -Property displayName,id,appId

A filter on an empty collection is an advanced query. It needs both the ConsistencyLevel: eventual header and $count=true. Without them, Graph returns an error. See advanced query capabilities.

Example 5 in Microsoft's List applications uses owners/$count eq 0 or owners/$count eq 1 to return apps with fewer than two owners. Watch single-owner apps too: removing that owner empties the list.

If you prefer a CSV, Microsoft publishes a PowerShell sample that exports app registrations with expiring secrets and certificates. Its Owner column reads <<No Owner>> for an app without an owner.

After expiry, authentication fails and the people who run the workload report it. The entries for secrets and certificates list what to check.

Why it happens

Microsoft adds the user who registers an application as its owner. Two administrator roles are an exception. Users in the Application Administrator and Cloud Application Administrator roles are not added as owners when they create app registrations or enterprise applications, according to the Entra built-in roles reference. An app that one of these administrators created can start with no owner at all.

An owner has the same permissions as an Application Administrator, limited to that one app. Without an owner, renewal needs a user in a role such as Application Administrator or Cloud Application Administrator. Those roles can manage all app registrations, but the administrators may not know which workload uses the credential or who runs it.

Renewal path

Find or assign an owner first. On the app registration, open Owners under Manage, or call GET /applications/{id}/owners as shown in List owners of an application. If the list is empty, look for a candidate in two places. The app's audit log shows who created or changed it. The Roles and administrators tab shows who holds permissions on it. Microsoft's ownership FAQ points to both for apps whose owner has left the organization, and they are also sensible places to start for an app that never had one.
Check how far back the audit log goes. Entra keeps audit logs for 7 days on Entra ID Free and 30 days on P1 or P2. Older entries exist only if you already routed the logs to a storage account through Azure Monitor, or if you use Microsoft Purview Audit Premium to retain them. A retention change does not bring back entries that have already expired. See Microsoft Entra data retention.
Assign at least two owners in the Entra admin center, or call POST /applications/{id}/owners/$ref. In delegated mode, Add owner requires the Application.ReadWrite.All and Directory.Read.All permissions plus the Application Administrator, Cloud Application Administrator, or Hybrid Identity Administrator role. If you used the read-only command above, reconnect with Connect-MgGraph -Scopes Application.ReadWrite.All,Directory.Read.All before the write. The request body names the new owner's object id:
```
POST https://graph.microsoft.com/v1.0/applications/{application-object-id}/owners/$ref
Content-Type: application/json

{
  "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/{new-owner-object-id}"
}
```
Set serviceManagementReference on the application to a team contact from your service or asset management database. The app then keeps a contact when a person leaves. Microsoft recommends this in the same ownership FAQ.
The new owner renews the credential with the matching entry for a client secret or a client authentication certificate. Before removing the old credential, check which credential the workload still uses and confirm every consumer has moved.
If the credential will expire before you can find an owner, an Application Administrator or Cloud Application Administrator can add the new credential. Both roles can manage all app registrations. See the built-in roles reference. Renew before expiry to prevent an outage, then keep searching for an owner.

Who should own it

Assign at least two application owners where possible, as Microsoft recommends. Record a team contact in serviceManagementReference so the app has a contact that does not depend on one person. See enterprise application ownership.

The identity team decides who owns which app. The owner then coordinates with the team that deploys the new credential.

Lead time and business-day math

Suggested planning buffer: 30 calendar days, the same as the core entries. That buffer assumes someone already owns the app.

For an ownerless app, finding an owner comes before the renewal clock starts. Start when the app first shows no owners, not when the credential enters its last 30 days. The audit log may cover only 7 or 30 days, which is another reason to start early. Then subtract weekends, holidays, approval time, and deployment freezes when scheduling the change.

The credential fails the same way as in the entries for an expired client secret and an expired client authentication certificate.

An owner who has left the company is a different case. The owner list is not empty, but the account behind it is deleted or disabled. See Entra app credential expired after the owner left. "Old credential removed too early" is planned as a separate entry.

Monitored by AppAlert

Not monitored

AppAlert reads owner email addresses during sync and labels a credential "No owners" when none are available, but it does not distinguish a truly ownerless application from one whose listed owners lack mail or a user principal name, so this failure mode is not directly monitored.