KBY Technologies Logo
Microsoft Entra ID · PowerShell 7.6

App registration secrets and certificates expiring soon

Which app registrations have a client secret or certificate that expires in the next 30 days, or has already expired?

Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Applications
# App registration client secrets and certificates that expire within -Days (or already have). Read-only.
param(
    [int]$Days = 30
)

Connect-MgGraph -Scopes 'Application.Read.All' -NoWelcome

$now = Get-Date
$limit = $now.AddDays($Days)

Get-MgApplication -All -Property 'id', 'appId', 'displayName', 'passwordCredentials', 'keyCredentials' |
    ForEach-Object {
        $app = $_
        $credentials = @(
            $app.PasswordCredentials | ForEach-Object { [pscustomobject]@{ Type = 'Client secret'; Credential = $_ } }
            $app.KeyCredentials | ForEach-Object { [pscustomobject]@{ Type = 'Certificate'; Credential = $_ } }
        )
        foreach ($entry in $credentials) {
            if ($entry.Credential.EndDateTime -le $limit) {
                [pscustomobject]@{
                    Application = $app.DisplayName
                    AppId       = $app.AppId
                    Type        = $entry.Type
                    Name        = $entry.Credential.DisplayName
                    KeyId       = $entry.Credential.KeyId
                    EndDateTime = $entry.Credential.EndDateTime
                    Expired     = $entry.Credential.EndDateTime -lt $now
                }
            }
        }
    } |
    Sort-Object EndDateTime

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

  • Covers credentials on application objects (App registrations). Credentials added to service principals (Enterprise applications) are not read.
  • Expired credentials are included and marked Expired = True. Pass -Days to change the window.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Connect-MgGraph (Microsoft.Graph.Authentication)Get-MgApplication (Microsoft.Graph.Applications)passwordCredential resource type: endDateTime, displayName, keyIdkeyCredential resource type: endDateTime, displayName, keyIdGet-Date (Microsoft.PowerShell.Utility)ForEach-Object (Microsoft.PowerShell.Core)Sort-Object (Microsoft.PowerShell.Utility)
All scripts