Skip to main content
Version: 0.15

Microsoft Entra ID (app registrations & service principals)

TokenTimer uses the Microsoft Graph API v1.0 to discover expiring client secrets and certificates from Entra ID (formerly Azure AD) app registrations and service principals. This is critical for preventing authentication failures when app credentials expire.

Token scope: https://graph.microsoft.com/.default

Commercial Azure only. Token minting uses https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token. National clouds (China, US Government, and similar) are not supported.

Authenticate with an Entra app via client credentials (authMethod: client_credentials plus tenant ID, client ID, and client secret; recommended) or a pasted Graph access token. Client credentials work for manual scans on Core and Enterprise. Where Enterprise auto-sync is entitled, client-credential or token configs can be stored for scheduled scans. Core scheduled auto-sync stays GitHub and GitLab; Entra auto-sync is not a Core capability.

Credential setup​

TokenTimer mints an access token from https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token using the OAuth 2.0 client-credentials grant. Scope: https://graph.microsoft.com/.default.

  1. Ensure you can grant admin consent for Microsoft Graph application permissions (Global Administrator or Privileged Role Administrator)
  2. Azure Portal → Microsoft Entra ID → App registrations → New registration
  3. Note the Directory (tenant) ID and Application (client) ID
  4. Certificates & secrets → New client secret → copy the value
  5. API permissions → Microsoft Graph → Application permissions → add Application.Read.All → Grant admin consent
  6. In TokenTimer, choose Client credentials (authMethod: client_credentials) and enter Tenant ID, Client ID, and Client secret
  7. On Core, credentials are used for the manual scan only and never stored. On Enterprise, they may be stored for auto-sync where entitled.

Directory.Read.All also works but is broader than this inventory needs.

Option B: Pasted access token (Azure CLI)​

  1. az login (account must be able to read app registrations)
  2. az account get-access-token --resource https://graph.microsoft.com
  3. In TokenTimer, choose Token auth and paste the accessToken value
  4. On Core, use immediately and discard: the token expires quickly and is never stored. On Enterprise auto-sync, prefer Option A so TokenTimer can mint fresh tokens.

Permissions required​

Microsoft Graph API permissions (application permission, admin consent required):

  • Application.Read.All (recommended least privilege for this inventory)
  • Directory.Read.All (broader alternative)
  • Application.ReadWrite.All (only if you already grant write access for other reasons)

Role requirements (for setup / admin consent of Graph application permissions):

  • Global Administrator or Privileged Role Administrator

What is discovered​

  • App registration client secrets: app name, secret name, expiration date (endDateTime)
  • App registration certificates: app name, certificate name, expiration, key type, usage
  • Service principal credentials: SP name, credential name, expiration (same fields as apps)

Metadata only. No actual secret values or certificate contents are retrieved.

Scan options​

  • Filter rules: optional include/exclude rules (exact or regex, on name or description) applied via the scan API. See Filter rules.
  • Remove obsolete items: opt-in cleanup that deletes previously imported tokens no longer found at the source. See Obsolete-token cleanup.
info

Microsoft Entra ID does not support auto-sync on self-hosted TokenTimer Core. Each scan is a one-time, manual action; credentials are used once and never stored. TokenTimer Enterprise adds scheduled auto-sync for this provider under a per-provider license entitlement, including client-credentials auth; see Enterprise auto-sync.