Script for getting Azure AD app registration secrets and certificates that expire soon

Just needed to clean up expired app registration secrets from a tenant, and figured I could just make a very quick script to find secrets and certificates that expire soon. Have fun – no explanation needed i guess.

Connect-AzureAD
$expiresWithinDays = 31
$expired = Get-AzureADApplication -All:$true | ForEach-Object {
    $app = $_
    @(
        Get-AzureADApplicationPasswordCredential -ObjectId $_.ObjectId
        Get-AzureADApplicationKeyCredential -ObjectId $_.ObjectId
    ) | Where-Object {
        $_.EndDate -lt (Get-Date).AddDays($expiresWithinDays)
    } | ForEach-Object {
        $id = "Not set"
        if($_.CustomKeyIdentifier) {
            $id = [System.Text.Encoding]::UTF8.GetString($_.CustomKeyIdentifier)
        }
        [PSCustomObject] @{
            App = $app.DisplayName
            ObjectID = $app.ObjectId
            AppId = $app.AppId
            Type = $_.GetType().name
            KeyIdentifier = $id
            EndDate = $_.EndDate
        }
    }
}

$expired | Out-GridView

2 thoughts on “Script for getting Azure AD app registration secrets and certificates that expire soon

  1. Hello Marius, I was wondering if there was an updated version of your script – When just running $expired = Get-AzureADApplication and then displaying the output, it doesn’t contain 3/4 of the app registrations within my tenant. I have put together a script that I keep breaking in powershell 🙂 that almost works but my problem lies where there are multiple certs or secrets for an app registration, it just displays ‘system.object’ instead of the expiration date – my script essentially goes through and displays expired, warning or good based on my threshold (I would share the script but I am trying to piece it back together into a working form) – do you have something newer that will get all app registrations and check for expire/soon to be expired certs and secrets but also accomodate for multiple certs/secrets per app registration?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s