Skip to main content
Version: next

Microsoft Entra ID (app registrations & service principals)

TokenTimer uses the Microsoft Graph API v1.0 to discover expiring client secrets and certificates from Entra ID (formerly Azure AD) app registrations and service principals. This is critical for preventing authentication failures when app credentials expire.

Token scope: https://graph.microsoft.com/.default

Credential setup​

  1. Ensure you have the Global Admin or Application Administrator role
  2. Using Azure CLI: az login
  3. Get a token: az account get-access-token --resource https://graph.microsoft.com
  4. Copy the accessToken value from the JSON response
  5. The token expires quickly. Use it immediately; it is never stored.

Alternative: use Azure Portal → Microsoft Entra ID → App registrations → create an app → API permissions → obtain a token via the OAuth2 flow.

Permissions required​

Microsoft Graph API permissions (one of):

  • Application.Read.All (application permission, admin consent required)
  • Application.ReadWrite.All (if you have write access)
  • Directory.Read.All (can read all directory objects)

Role requirements:

  • Global Admin, Application Administrator, or Cloud Application Administrator

What is discovered​

  • App registration client secrets: app name, secret name, expiration date (endDateTime)
  • App registration certificates: app name, certificate name, expiration, key type, usage
  • Service principal credentials: SP name, credential name, expiration (same fields as apps)

Metadata only. No actual secret values or certificate contents are retrieved.

info

Microsoft Entra ID does not support auto-sync on self-hosted TokenTimer. Each scan is a one-time, manual action; credentials are used once and never stored.

  • Azure Key Vault to scan Key Vault secrets, certificates, and keys instead of app credentials