How to find expiring Entra (Azure AD) client secrets

An expired client secret on an app registration breaks sign-in for whatever depends on it, often at an inconvenient time. The portal shows secrets one app at a time, so a practical approach is to export them once and track the dates.

What goes wrong when a secret expires

Applications that authenticate with the secret start failing with error AADSTS7000222 (InvalidClientSecretExpiredKeysProvided), which Microsoft documents as meaning the provided client secret keys are expired. Entra does not email app owners about expiring client secrets by default. A portal recommendation, "Renew expiring application credentials", flags credentials within 30 days of expiry, but it appears only to admins who look and may depend on licensing, so expiries are still often found by users first.

See one app in the portal

In the Microsoft Entra admin center go to Entra ID → App registrations, open the app, then Certificates & secrets (menu names change; use the search box if you do not see it). Each secret is listed with its description and expiry date. The secret value is shown only when you create it, so you cannot copy it later.

List the app registrations at once

This read-only PowerShell snippet exports the secrets and certificates on every app registration:

# Read-only. Needs the Microsoft.Graph PowerShell module and the Application.Read.All permission.
Connect-MgGraph -Scopes "Application.Read.All"

Get-MgApplication -All | ForEach-Object {
  $app = $_
  foreach ($s in $app.PasswordCredentials) {
    [pscustomobject]@{ AppName = $app.DisplayName; AppId = $app.AppId; Type = "Secret"; Name = $s.DisplayName; Expires = $s.EndDateTime }
  }
  foreach ($c in $app.KeyCredentials) {
    [pscustomobject]@{ AppName = $app.DisplayName; AppId = $app.AppId; Type = "Certificate"; Name = $c.DisplayName; Expires = $c.EndDateTime }
  }
} | Export-Csv -Path entra-credentials.csv -NoTypeInformation

This snippet lists the client secrets and certificates stored on app registrations in the tenant. It does not list SAML signing certificates, credentials on enterprise applications (service principals) or federated credentials. The signed-in account also needs a directory role that can read app registrations, such as Global Reader or Application Administrator. If you are unsure, try it in a test tenant first, and re-run it after you rotate anything because an export goes stale.

Then open the tracker, choose Import CSV and select entra-credentials.csv. The file is read in your browser and never uploaded.

Renewing without downtime

1. Create a new secret on the same app registration before the old one expires.
2. Update the application or key vault that holds the secret.
3. Confirm sign-ins succeed with the new secret.
4. Delete the old secret.

Microsoft recommends certificates or federated credentials over client secrets in production, and managed identities where they fit.

Questions

How long can a client secret last?

The portal offers preset lifetimes and a custom end date, up to 24 months. Microsoft recommends under 12 months, and tenant policy can restrict the maximum further.

Does Entra email me before a secret expires?

Entra emails admins about SAML signing certificates, but we found no documented default email for app registration secrets. A portal recommendation flags credentials within 30 days of expiry; check whether it is available in your tenant.

Track this in the free tracker

Guides last checked 2026-10-18. Check the details against your vendor's current documentation; products and policies change.