What this check looks at
Reports app registration secrets and certificates that have expired or expire within the warning window.
App registrations authenticate with client secrets (generated passwords) or certificates, and both have an end date: secrets created in the Microsoft Entra admin centre last at most two years. When a credential expires, whatever uses it stops authenticating. Microsoft Entra ID neither removes expired credentials nor warns anyone except, sometimes, the app’s owners, and many apps have none.
This check reads every app registration’s secrets and certificates. The check fails when any credential has already expired, listing those and any that expire soon, and warns when none has expired but at least one expires within 60 days.
Expired credentials cause outages: the backup product stops backing up mailboxes, the HR system stops creating accounts, the scanner stops filing to SharePoint, often silently until someone notices missing data. Old credentials left in place clutter the inventory, hide which one is live and tempt people into long-lived secrets as a quick fix, while a valid secret nobody tracks may still sit in an old script or on a leaver’s laptop.
Why it matters
Expired credentials cause outages in the integrations businesses depend on — payroll feeds, ticketing, backup. Expired credentials that are never cleaned up also leave a misleading inventory behind.
A typical case: a 50-person firm’s third-party Microsoft 365 backup used an app secret created two years earlier. It expired, the backup jobs failed with an authentication error nobody was watching, and when a user deleted a SharePoint library two months later there was no recent backup to restore. Rotating the secret beforehand would have taken ten minutes.
Tidying credentials also reduces risk: every secret is a password for a non-human identity that MFA does not protect. Fewer, shorter-lived credentials with named owners are easier to rotate quickly after a suspected leak.
ISO 27001 A.5.17 (authentication information) expects secrets to be managed through their life, and CIS Controls v8 safeguard 5.5 asks for an inventory of service accounts. The NCSC 10 Steps identity and access management guidance and the NCSC CAF identity and access management outcome apply the same to non-human identities.
How to fix it
Where: Entra admin centre → Identity → Applications → App registrations → Certificates & secrets
Before you start
- Find who owns each integration; rotating a secret needs the new value entered in the other system at the same time.
Step by step
- List the expired and expiring credentials. From the evidence, list the apps with expired or expiring credentials. In the Microsoft Entra admin centre go to Entra ID > App registrations > All applications, open each app and select Certificates & secrets; the Client secrets and Certificates tabs show each credential’s description, expiry date and ID.
- Find who uses each app. Check the app’s Owners page and ask the client who runs the integration. In Entra ID > Monitoring & health > Sign-in logs > Service principal sign-ins, filter on the app to see whether it still signs in and which credential it uses (the credential key ID in each sign-in’s details).
- Rotate credentials that expire within 60 days. Add the new credential before removing the old one: on Certificates & secrets, upload a certificate (preferred) or select New client secret with an expiry of 12 months or less. Enter it in the system that uses the app together with its owner, test that the integration works, then delete the old credential.
- Delete expired credentials. Select each expired secret or certificate and choose Delete. An expired credential cannot authenticate, so removing it changes nothing except the inventory. In Microsoft Graph PowerShell a secret can be removed with Remove-MgApplicationPassword -ApplicationId <object id> -KeyId <key id>.
- Retire apps that are no longer used. If an app whose only credential has expired has had no sign-ins for months and nobody claims it, the integration is dead: set Enabled for users to sign in? to No on its enterprise application (Properties), and delete the app registration after a month.
- Give every app owners and renewal reminders. Add at least two owners to each app registration (Owners > Add owners), and put each credential’s expiry date in the MSP’s ticketing system or calendar with a reminder 30 days ahead.
- Confirm nothing has expired. Reopen Certificates & secrets on each listed app: there should be no expired entries, and the earliest expiry should be more than 60 days away. The finding clears at the next assessment.
What users will notice
An integration using an expired secret has already stopped working; one whose secret expires soon will stop at that date unless rotated.
How to confirm it worked
App registrations, the app, Certificates and secrets: no expired entries, and the next expiry is beyond the rotation window.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM) |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | IM-8 Restrict the exposure of credentials and secrets |
| Zero Trust | Applications |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 8.6.3 Passwords for application and system accounts are protected |
| NIST SP 800-171 | 3.5.2 Authenticate users, processes and devices |
| CMMC Level 2 | IA.L2-3.5.2 Authentication |
| ISO 27001:2022 | A.5.17 Authentication information |
| CIS Controls v8.1 | 5.5 Establish and maintain an inventory of service accounts (IG2) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Application credentials (Microsoft Learn)