Azure KV Secret Near Expiry is dormant/not firing

Question

Given KV Events, the SecretNearExpiry is no longer firing or probably is going who knows where! that EventSubscription is not firing up, I'be been adding for my secret, 30 days, for instance if I create the Secret on 2/27/25 5:00 PM, I'm updating the expiration date as 3/29/25 5:15 PM, and it was working yesterday, and also a portion of today, I could see those events coming, but at this time I cannot recall exactly what did I change since I was not testing over and over, the only think I'm sure is that I was deleting some EventGrid extra subscriptions , but at least I should be able to see messages in the Event Subscription when something got triggered, true? the service bus queue is the same for the Create Key and for the SecretNearExpiry, it is simply not firing up, Create Key was working but now is no longer working

I discover also that in one of my integration tests, in the application properties for one of my secrets was still referring to an already deleted event grid subscription,

I can see in the Azure Logs that certain event subscription got deleted, then, why still is coming in the metadata of the secret!

Answer 1

Hi ,

Thanks for reaching out to Microsoft Q&A.

A few things can cause “SecretNearExpiry” (and other Keyvault events) to stop arriving even though the Event Grid subscription still appears in the portal.

In general, i suggest you to verify each of the following:

1. Check the actual subscription hooked to your Key Vault
   • In the portal (or via CLI/PowerShell), ensure that the Microsoft.KeyVault.SecretNearExpiry” subscription really is associated with the same Key Vault and the same system topic. Sometimes we end up looking at an old or deleted subscription, or the Key Vault is pointing to a stale system topic.
   • Verify the subscription’s status is “enabled” and not in a failed or disabled state.

Verify no advanced filters block the event

• If you set an Advanced Filter on eventType or on any Key Vault property, make sure it doesn’t exclude “SecretNearExpiry.” A slightly wrong filter can silently discard your events.

1. Confirm your expiration window is truly “near”

• Key Vault typically treats “near expiry” as roughly 30 days or less. If you keep adjusting the expiration in a way that no longer satisfies the “near expiry” calculation, the event won’t fire.
  • Test a secret that expires much sooner (1–2 days from now?) so you can confirm the event is triggered in a tight window.

Double‐check the endpoint (Service Bus Queue)

• Make sure the queue name hasn’t changed or that the subscription is not referencing the wrong queue. Also check if messages might be showing up in “Dead‐letter” or “Poison” subqueues.
  • If the queue or SAS credentials changed, you may have to recreate or update the subscription.

1. Look at the metrics & logs for the actual subscription
   • In the Azure portal, under “Event Subscriptions” for your Key Vault --> “Metrics,” see if any “Publish Failed Events” or “Dead‐Lettered Events” show up. If no events are published at all, you are likely dealing with the wrong subscription or a filter mismatch.
   • You can also query Activity Logs to see if the subscription was disabled or if a “Delete” or “Update” operation was applied.
   Remove or fix references to the deleted Event Grid subscription
   • If your code/ARM templates/TF references an old subscription ID that was deleted, you’ll see weird behavior or no events at all. Removing or updating that reference in your IaC, config files, etc. can help clear it up.

In short, the typical culprit is that the Key Vault’s near expiry window doesn’t line up with your new expiration date or there is a mismatch or filter problem on the newly created (or presumed existing) subscription. Double check that you really do have a working subscription for “SecretNearExpiry” with an endpoint that is accepting messages and that your secret’s expiry fits in the near expiry threshold. Once you straighten out the correct subscription and filters, you should see near expiry events flowing again.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.