Confirm connection and initial sync
Open Operations. If Admin consent required is shown, follow Approval and connection. If Connected. Sync in progress is shown, follow Wait for the initial sync and use Check status after allowing the sync to finish.
An existing inventory can remain visible after Microsoft access is revoked. Stored records alone do not prove that the latest sync succeeded. See the permission and access boundary.
Check the view and filters
Clear credential-type filters and, if present, Clear routing filter. The Operations action queue covers expired credentials and those expiring within 90 days. A valid credential with a later expiry can be tracked without appearing in the urgent queue.
Use the application or service-principal inventory to check the resource itself. Confirm that you are comparing the same application, credential type, and expiry rather than two similarly named records. Operations queue explains what each view means.
Check coverage
AppAlert reads supported expiry metadata for client secrets, client authentication certificates, SAML signing certificates, and Application Proxy SSL certificates. It does not read raw secret values or private keys. Agent identity inventory is separate from the Operations credential queue.
Open the matching renewal guide and read its Monitored by AppAlert section for the precise coverage disclosure. A guide describing an application does not imply that AppAlert observes every part of that application's configuration or health.
Check sync freshness
Review the sync information available in the app. A renewal or owner change made in Microsoft Entra needs a subsequent successful sync before the inventory can reflect it. Wait for the next scheduled sync. If the inventory remains stale, contact AppAlert support with the last successful sync time so an authorized platform administrator can investigate or start a manual sync.
In Organization Settings, Owner routing readiness uses the older of the completed application and enterprise application sync timestamps. Data older than 24 hours is marked stale; missing completed sync history is reported as missing. Resolve that warning before treating the owner-routing counts as current.
Verify the expected result
After a successful sync, check the credential's updated expiry and owner context. If an expected record is still absent, note the resource type, the discrepancy, and the last successful sync time when contacting support. Do not include credential values or private keys.
For a credential that is present but has no email, continue with Missing notifications. Inventory presence and notification eligibility are separate checks.