Track Microsoft Entra app secret and certificate expiry
AppAlert monitors application secrets, application certificates, SAML signing certificates, and Application Proxy SSL certificates. It emails admins before expiry, optionally routes alerts to application owners, and records each send attempt.
Sign in with Microsoft → an admin approves read-only access → the first inventory sync starts
Track expiry dates for Microsoft Entra application secrets, application certificates, SAML signing certificates, and Application Proxy SSL certificates.
View credential coverageEmail your admin recipients before expiry. To reach owners too, turn on owner routing in alert settings; credentials without a usable owner address go to admins. Notification Audit records each send attempt.
View email alertsAlready using Microsoft's expiry emails or your own script? Compare built-in, DIY, and AppAlert.
AppAlert keeps expired and soon-to-expire credentials in the Operations queue so your team can prioritize renewals.
AppAlert uses read-only Microsoft consent. It reads metadata and never receives raw secret values or certificate private keys. See permissions and data.
AppAlert handles expiry monitoring and email alerts without Logic Apps, Storage Accounts, or reminder scripts for your team to operate.
Microsoft built-in, DIY, or AppAlert
Microsoft Entra already sends some expiry warnings, and you can build your own monitor with Microsoft Graph. Microsoft behavior below comes from the linked Microsoft Learn pages. Where those sources say nothing, the cell says Not documented or Depends on your build. For details, read Expiry notifications from Microsoft and Monitor credential expiry.
| Comparison | Microsoft built-in | DIY monitor | AppAlert |
|---|---|---|---|
| Credential types covered | App registration secrets and certificates expiring within 30 days appear as a preview recommendation. Service principal credentials, including the SAML signing certificate renewal path, have a separate recommendation. SAML signing certificates also get expiry emails. Application Proxy SSL certificates: Not documented. | Secrets and certificates in passwordCredentials and keyCredentials on app registrations and service principals. Application Proxy SSL certificates: Depends on your build; they need a separate check. | Application secrets, application certificates, SAML signing certificates, and Application Proxy SSL certificates. See credential coverage. |
| Who receives the warning | Recommendation emails (preview) go to users with the Application Administrator role when a recommendation is new, not to app owners. With Privileged Identity Management, only active role holders receive them. SAML expiry emails go to up to five configured addresses. Choosing other recipients for recommendation emails: Not documented. | Depends on your build. A log search alert notifies the action group you select. Graph sendMail sends as the user you call it for. | Admin recipients you configure in Organization Settings, plus application owners when owner routing is on. |
| Thresholds per credential type | Both recommendations list credentials within 30 days of expiry (applications, service principals). SAML emails go out 60, 30 and 7 days before expiry. Changing these thresholds: Not documented. | Depends on your build. You set the warning days in your script or in the alert query, and you track which threshold already sent for each credential. | Days-before-expiry thresholds for each credential type, set in Organization Settings. |
| Owner routing with admin fallback | Not documented. The recommendation email targets the role holder, and users in the Application Administrator role are not added as owners of applications they create. | Depends on your build. Graph can list application owners; the routing, the fallback when an owner leaves, and empty owner lists are logic you maintain. | Optional. Usable owner addresses from the synced inventory receive alerts. Credentials without one fall back to admin recipients, and admins can receive a Bcc copy. See alert settings. |
| Record of who was warned | Not documented. Microsoft's email settings guide describes a summary and links, not a per-credential record of who was warned. | Depends on your build. Store the intended recipients, send time, and delivery result yourself. | Notification Audit records each send attempt and keeps records for 365 days. “Sent” means the email provider accepted the message. |
| Infrastructure to operate | Recommendations appear in the Microsoft Entra admin center under Entra ID > Overview > Recommendations. Recommendation emails are on by default. | A scheduled script, such as an Azure Automation runbook or a Logic Apps Recurrence trigger. For alerts, a Log Analytics custom table fed by the Logs Ingestion API and a log search alert rule, plus a separate alert when collection fails. | None for your team. AppAlert is hosted, so there are no Logic Apps, Storage Accounts, or reminder scripts to run. |
| Permissions required | Reports Reader, Security Reader, or Global Reader can read the recommendation; Graph access uses DirectoryRecommendations.Read.All. A Security Administrator can turn off recommendation emails. | Application.Read.All to list applications and service principals; for an Azure Automation runbook, granted to its managed identity as an app role. Graph sendMail also needs Mail.Send. Other reads: Depends on your build. | Read-only Microsoft consent, including Application.Read.All and Directory.Read.All for Application Proxy publishing metadata and owner records. See permissions and data. |
| Cost | Microsoft's sample response lists microsoftEntraWorkloadId under requiredLicenses, and license requirements for preview recommendations can change. SAML expiry emails: Not documented. | Depends on your build: the Azure services you run and your team's maintenance time. Azure service prices are not covered here. | Free during Early Access. The intended price afterwards is $200 per month per organization, with unlimited applications and credentials. Billing is not available yet. See pricing. |
When built-in or DIY is enough
SAML signing certificates are your main concern and up to five fixed addresses reach the people who renew them. For app registration credentials, it is enough when an Application Administrator reviews Entra recommendations and 30 days covers your approvals and deployment.
Your team already runs Azure Automation or Logic Apps with Azure Monitor and wants to own the inventory. Plan to maintain thresholds, owner lookup, a failed-collection alert, and your own record of who was warned. Follow Monitor credential expiry.
You want Application Proxy SSL coverage, thresholds per credential type, owner routing with admin fallback, and a record of each send attempt without operating the pipeline.
Microsoft sources
- Renew expiring application credentials (recommendation) (opens in a new tab)
- Renew expiring service principal credentials (recommendation) (opens in a new tab)
- Microsoft Entra recommendations overview (opens in a new tab)
- Configure recommendation email notifications (opens in a new tab)
- Manage certificates for federated single sign-on (opens in a new tab)
- Microsoft Entra built-in roles (opens in a new tab)
- Microsoft Graph: List applications (opens in a new tab)
- Microsoft Graph: List service principals (opens in a new tab)
- Microsoft Graph: List application owners (opens in a new tab)
- Azure Automation managed identity (opens in a new tab)
- Assign an app role to a managed identity (opens in a new tab)
- Logic Apps recurring workflow schedules (opens in a new tab)
- Azure Monitor Logs Ingestion API (opens in a new tab)
- Create an Azure Monitor log search alert rule (opens in a new tab)
- Microsoft Graph: sendMail (opens in a new tab)
Start with the credential types.
Review the four credential types AppAlert monitors, then see how email routing works.