Get alerted before Entra app registration secrets and certificates expire

An expired client secret takes an integration down silently, and the first sign is usually a failing pipeline or a support ticket. Entra shows every expiry date on the app registration blade and does nothing with it. The feedback request for native alerting has been open for years with hundreds of votes.

• Enumerates every app registration in the tenant and every client secret and certificate on it.
• Alerts at your chosen thresholds before expiry, and keeps alerting daily until the credential is rotated.
• Reports expired credentials separately, so what is already broken is never buried under what is about to be.
• Reads credential metadata only: names, ids, and expiry dates. Secret values are never readable.
• Posts an Adaptive Card to your Teams channel; nothing is stored or sent anywhere else.

• It reports; it does not rotate. Rotation stays a deliberate human step with your deployment pipeline.
• Credentials on enterprise applications (service principals) that are not app registrations in this tenant are outside its view.
• Read-only. This app reports and alerts; it changes nothing in your subscription.

A serverless function on a schedule, with a system-assigned managed identity, deployed into your subscription by the Azure Marketplace. Roles are granted by you after deployment with the one-line script in the package, so nothing runs until you say so. Every role it asks for, and why:

Alerts go to the Teams webhook you configure. Nothing is sent anywhere else.