Azure AD REST connector - Client Secret Expiry Notification

[IDAM09]

Hello,

Is there any option to receive notification prior to Azure AD Client Secret expiry?

[rushikeshvartak]

• You can setup this notifications outside saviynt using cyberark and all.
• If you need notification from saviynt. Store password expiry date in endpoint customproperty and use analytics to send notifications

• Here are some options:

  1. Azure AD Blade in Azure Portal

  • Manual Checking: Azure Portal allows you to manually check the expiry dates of client secrets. Go to Azure Active Directory > App registrations > Your App. Under the Certificates & Secrets section, you can see the expiration dates for client secrets.
  • Azure AD Insights: Microsoft introduced some improvements to Azure AD Insights which may send alerts related to expiring credentials, but this is still limited in scope.

  2. Azure AD Graph or Microsoft Graph API

  • You can use Microsoft Graph API to list and monitor the expiration dates of client secrets programmatically. A script can be created to periodically query the API and check for upcoming expirations.

  Example using Microsoft Graph API:

  • Endpoint: GET https://graph.microsoft.com/v1.0/applications/{appId}/passwordCredentials
  • This will return the client secret details, including the expiration date.

  You can then compare the expiration date to the current date and trigger a notification if the secret is set to expire soon.

  3. PowerShell Script with Automation

  You can use a PowerShell script to automate the process of checking for expiring client secrets. This script can run on a schedule and send an email or other alerts when a secret is nearing expiration.

  Sample PowerShell snippet:

  $appId = "your-app-id"
  $secrets = (Get-AzADApplication -ApplicationId $appId).PasswordCredentials
  foreach ($secret in $secrets) {
      $expiryDate = $secret.EndDate
      if ($expiryDate -lt (Get-Date).AddDays(30)) {
          # Send an alert (e.g., email notification)
          Write-Host "Client Secret expiring on $expiryDate"
      }
  }

  You can set this script up in an Azure Automation runbook to execute periodically.

  4. Azure Monitor and Log Analytics

  Azure Monitor with Log Analytics can be configured to track client secret expirations and send alerts.

  Steps:

  • Enable Azure Activity Logs to be sent to a Log Analytics workspace.
  • Set up a Log Query to monitor secret expiration events and trigger alerts when secrets are close to expiring.

  5. Third-Party Monitoring Tools

  Some third-party cloud monitoring tools like Datadog, PagerDuty, or Splunk offer integrations with Azure and can be configured to monitor client secrets, certificates, and other Azure resources for expiration.

  6. Azure Key Vault (for managing secrets)

  If you're storing secrets in Azure Key Vault, you can set up Key Vault Event Grid notifications to alert you when secrets are about to expire.

[NM]

@IDAM09 i believe Azure also provides a way which notifies you when a secret expires.