App & Service Principal Credential Expiry
The question it answers: Which client secrets and certificates on app registrations and enterprise applications have expired or expire soon?
Every client secret and certificate on an app registration or enterprise application, with the time left before it expires. An expired credential silently breaks whatever integration uses it. Source: Microsoft Graph applications and servicePrincipals. Graph cannot filter on expiry, so all credentials are fetched and filtered here. What to do: expired credentials are usually already causing failures - check the owning app first. Certificates are listed alongside secrets; both stop an app-only integration when they lapse. A credential with no expiry date is rare and worth reviewing on its own.
At a glance
Section titled “At a glance”| Where in the app | Entra ID › Security › App Credential Expiry |
| Workload | Entra ID |
| Kind | Table |
| Data | Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once. |
| Licence | No extra licence needed. |
| Report id (API and MCP) | entra.security.app-credential-expiry |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Application | DisplayName | Link |
| Object type | OwnerObjectType | Text |
| Credential | CredentialType | Text |
| Name | CredentialName | Text |
| Status | ExpiryState | Status |
| Expires | EndDateTime | Date |
| Days left | DaysUntilExpiry | Text |
| App Id | AppId | Text |
Filters
Section titled “Filters”| Filter | Key (API) | On when the page opens |
|---|---|---|
| Show only expired or expiring within the expiry warning days (Settings) | at-risk | Yes |
What it needs
Section titled “What it needs”Licence: No extra licence needed.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Application.Read.All | Microsoft Graph | Read all applications |
Data sources it reads
GET /v1.0/applicationsGET /v1.0/servicePrincipals
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/entra.security.app-credential-expiry?size=100GET /ir-api/v1/reports/entra.security.app-credential-expiry?filter=at-riskAn AI assistant reads it with the MCP tool get_report and the id entra.security.app-credential-expiry. The client needs the Read grant for Entra ID. See Using the API.