Cert Expiry Tracker

Track expiring certificates on Entra app registrations

Certificates uploaded to an app registration are a better choice than client secrets for production, but they expire too. For certificates you upload, the expiry is whatever the certificate itself carries.

Where to see them

Open Entra ID → App registrations → your app → Certificates & secrets → Certificates. Each entry shows a thumbprint, start date and expiry date.

Export them

The same read-only snippet used for secrets also lists certificates (the KeyCredentials on each app). The certificate display name is optional and may be blank.

# Read-only. Needs the Microsoft.Graph PowerShell module and the Application.Read.All permission.
Connect-MgGraph -Scopes "Application.Read.All"

Get-MgApplication -All | ForEach-Object {
  $app = $_
  foreach ($s in $app.PasswordCredentials) {
    [pscustomobject]@{ AppName = $app.DisplayName; AppId = $app.AppId; Type = "Secret"; Name = $s.DisplayName; Expires = $s.EndDateTime }
  }
  foreach ($c in $app.KeyCredentials) {
    [pscustomobject]@{ AppName = $app.DisplayName; AppId = $app.AppId; Type = "Certificate"; Name = $c.DisplayName; Expires = $c.EndDateTime }
  }
} | Export-Csv -Path entra-credentials.csv -NoTypeInformation

This snippet lists the client secrets and certificates stored on app registrations in the tenant. It does not list SAML signing certificates, credentials on enterprise applications (service principals) or federated credentials. The signed-in account also needs a directory role that can read app registrations, such as Global Reader or Application Administrator. If you are unsure, try it in a test tenant first, and re-run it after you rotate anything because an export goes stale.

Then open the tracker, choose Import CSV and select entra-credentials.csv. The file is read in your browser and never uploaded.

Renewal checklist

  1. Issue the new certificate (or generate a new key pair and CSR) well ahead of expiry.
  2. Upload the public part to the app registration. Microsoft's own rotation steps add the new credential first and remove the old one afterwards.
  3. Switch the application to sign with the new private key.
  4. Remove the old certificate once nothing uses it.

Different from SAML signing certificates

Certificates on enterprise applications used for single sign-on are a separate item. See SAML signing certificate expiry.

Questions

Can I have two certificates at once?

Microsoft's rotation guidance adds the new credential before removing the old one, so yes in practice. Check your tenant for any per-app limit.

Track this in the free tracker

Guides last checked 2026-10-18. Check the details against your vendor's current documentation; products and policies change.