# Entra ID - Monitor Application Secrets

> Monitor expiring EntraID application secrets and notify responsible.

This workflow scans all Microsoft Entra ID (Azure AD) application registrations via Microsoft Graph and identifies client secrets and certificates that are expired or nearing expiration within a configurable time window. It separates secrets and certificates, calculates the remaining validity in days and consolidates the results into a single, easy-to-read HTML report. An email notification is sent only when expiring credentials are found, helping administrators proactively rotate credentials and avoid service disruptions. Ideal for IT administrators, security teams and DevOps engineers who want continuous visibility into credential health across Entra ID app registrations.

- Area: n8n Automation
- Type: Free
- Category: IT Operations
- n8n template: https://n8n.io/workflows/12399-email-reports-on-expiring-microsoft-entra-id-app-secrets-and-certificates-with-microsoft-graph/
- Source: https://www.sus-tech.com/en/solutions/monitor-entraid-application-secrets

## Monitor expiring EntraID application secrets and notify responsible

Stay ahead of credential expirations by automatically detecting Entra ID application client secrets and certificates that are about to expire and sending a neatly formatted email report.

### What this workflow solves

Expired client secrets and certificates are a common cause of unexpected outages and failed integrations. Manually checking expiration dates across many Entra ID applications is tedious and easy to miss. This workflow automates the discovery and reporting of credentials that will expire within a configurable time window.

### Key features

- Fetches all **Microsoft Entra ID applications** along with:
    
    - Client secrets (`passwordCredentials`)
        
    - Certificates (`keyCredentials`)
        
- Splits credentials into individual entries for easier processing
    
- Filters credentials expiring **within the next _N_ days** (configurable)
    
- Normalizes results into a consistent structure including:
    
    - Application name
        
    - App ID
        
    - Credential type (Client Secret / Certificate)
        
    - Credential name + ID
        
    - Days remaining until expiration
        
- Generates an **HTML table report**, sorted by application name
    
- Sends an email **only when expiring items are found** (otherwise does nothing)
    

### How it works

1. Fetches all Entra ID applications and their credential metadata via Microsoft Graph  
2. Separates client secrets and certificates into individual entries  
3. Filters entries that expire within the configured time window  
4. Builds a normalized list of expiring items with days remaining  
5. Emails an HTML table report (only if results exist)    

### Setup requirements

- Microsoft Entra ID app registration with Microsoft Graph **Application permissions**:
    
    - `Application.Read.All`
        
- In n8n:
    
    - Create **Microsoft Graph OAuth2** credentials (Client Credentials flow recommended)
        
    - Assign those credentials to the **Get EntraID Applications and Secrets** HTTP Request node
        
- Update the **Set Variables** node:
    
    - `notificationEmail`: where to send the report
        
    - `daysBeforeExpiry`: alert window in days (e.g., 14)
        

### Notes

- The email table highlights soon-to-expire credentials more prominently (based on remaining days).
    
- For automation, replace the manual trigger with a **Schedule Trigger** (e.g., daily/weekly).
    
- The workflow accesses **metadata only** (names/IDs/expiry), not secret values.

## Related blog posts

- [Closing Access Gaps: The Role of Automation in Identity Governance](https://www.sus-tech.com/en/blog/the-role-of-automation-in-identity-governance.md)
- [Preventing Outages Before They Happen: Monitoring Application Credentials in Entra ID](https://www.sus-tech.com/en/blog/preventing-outages-monitoring-application-credentials.md)

## Contact

Consulting and implementation: https://www.sus-tech.com/en/contact