Skip to main content

Microsoft Entra ID (app registrations & service principals)

TokenTimer uses the Microsoft Graph API v1.0 to discover expiring client secrets and certificates from Entra ID (formerly Azure AD) app registrations and service principals. This is critical for preventing authentication failures when app credentials expire.

Token scope: https://graph.microsoft.com/.default

Commercial Azure only. Token minting uses https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token. National clouds (China, US Government, and similar) are not supported.

Authenticate with an Entra app via client credentials (authMethod: client_credentials plus tenant ID, client ID, and client secret; recommended) or a pasted Graph access token. Credentials are used for the scan only and are never stored for TokenTimer Cloud manual import. TokenTimer Cloud has no scheduled auto-sync for Entra ID (or any provider).

Credential setup​

TokenTimer mints an access token from https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token using the OAuth 2.0 client-credentials grant. Scope: https://graph.microsoft.com/.default.

  1. Ensure you can grant admin consent for Microsoft Graph application permissions (Global Administrator or Privileged Role Administrator)
  2. Azure Portal → Microsoft Entra ID → App registrations → New registration
  3. Note the Directory (tenant) ID and Application (client) ID
  4. Certificates & secrets → New client secret → copy the value
  5. API permissions → Microsoft Graph → Application permissions → add Application.Read.All → Grant admin consent
  6. In TokenTimer, choose Client credentials (authMethod: client_credentials) and enter Tenant ID, Client ID, and Client secret
  7. Credentials are used for the scan only and never stored

Directory.Read.All also works but is broader than this inventory needs.

If Tenant ID is already a GUID, TokenTimer uses it as-is and does not call OpenID discovery. A tenant domain is canonicalized to that GUID via /{tenant}/v2.0/.well-known/openid-configuration before minting, and results are attributed to that GUID. A discovery rate-limit or Microsoft outage is reported as such, not as a bad tenant.

This identity is for inventory import, not CertOps Azure DNS. DNS-01 uses a separate Entra app with DNS Zone Contributor; see Azure DNS. Do not reuse that app for inventory unless you intentionally want both roles on one identity.

Option B: Pasted access token (Azure CLI)​

  1. az login (account must be able to read app registrations)
  2. az account get-access-token --resource https://graph.microsoft.com
  3. In TokenTimer, choose Token auth and paste the accessToken value
  4. Use immediately. The token expires quickly; it is never stored.

Azure CLI Graph tokens are JWTs; TokenTimer reads the tenant from the tid claim. An opaque token with no tenant GUID is rejected. Client-credential scans do not use that claim: they pass the GUID you entered, or the GUID from OpenID discovery.

Permissions required​

Microsoft Graph API permissions (application permission, admin consent required):

  • Application.Read.All (recommended least privilege for this inventory)
  • Directory.Read.All (broader alternative)
  • Application.ReadWrite.All (only if you already grant write access for other reasons)

Role requirements (for setup / admin consent of Graph application permissions):

  • Global Administrator or Privileged Role Administrator. Application Administrator and Cloud Application Administrator cannot consent to Graph application permissions.

What is discovered​

  • App registration client secrets: app name, secret name, expiration date (endDateTime)
  • App registration certificates: app name, certificate name, expiration, key type, usage
  • Service principal credentials: SP name, credential name, expiration (same fields as apps)

Metadata only. No actual secret values or certificate contents are retrieved.

Scan options​

  • Filter rules: optional include/exclude rules (exact or regex, on name or description) applied via the scan API. See Filter rules.
  • Remove obsolete items: opt-in cleanup that deletes previously imported tokens no longer found at the source. See Obsolete-token cleanup.