Skip to content

App Registration Secrets: Expiry and Renewal

An app registration in Microsoft Entra ID that signs in with a client secret stops working when the secret expires. This page explains how to renew a secret without an outage and how expiry monitoring usually works.

Monitoring is a platform choice

The notifications described below are provided by some platforms as an automation. The MCP spoke baseline does not create it for you. Ask your platform team whether it exists, how long before expiry it notifies and who has to be an owner. If it does not exist, put the expiry dates of your secrets in your own calendar or alerting.

Prefer workload identity federation or managed identities over client secrets where the service supports them. Then nothing expires. See How to use your spoke.

Renew a secret

Set client secrets to expire after one year or less. Do not pick a longer period.

  1. Sign in to the Azure portal.
  2. Open Microsoft Entra ID and select App registrations.
  3. Select My applications or All applications and open the app registration whose secret must be renewed.
  4. Select Certificates & secrets in the left menu.
  5. Under Client secrets, select + New client secret.
  6. Enter a description, select an expiration of one year or less and select Add.
  7. Copy the secret value now and store it safely (for example in a Key Vault). The value is shown only once. The Secret ID is not the secret.
  8. Update the application or deployment configuration with the new secret, and check that the application can sign in.
  9. When the application uses the new secret, remove the old secret under Certificates & secrets.

Do the steps in this order: a second secret can exist next to the old one, so the application never has a moment without a valid secret.

E-mail notifications (where available)

A typical set-up:

  • An e-mail is sent when a secret expires within 14 days.
  • Each expiring secret triggers a notification once.
  • Notifications go to the owners of the app registration. With no valid owner, no e-mail is sent. The platform team can then create a work item to contact the responsible team and arrange ownership.
  • Use dedicated administrative accounts as owners if your organisation separates them from personal accounts, and not personal user accounts. Your organisation sets which account type counts as valid.
  • To let several people receive the notification, add all of them as owners of the app registration.

Check the owners of your app registrations when team members change. For ownership and access in general, see Access, groups and PIM.