Entra Verified ID - Credential Expiration and Renewal Notifications

Question

I am wondering if it is possible to make a Verified ID credentials expiration be longer than 6 months, like maybe 12? I also was wondering about notifications to employees about the upcoming expiration of their credential and the need to renew. Does anybody know how to set that up or what solutions have people put in place?

Answer 1

Hello @Shawn Dvoracek,

Thank you for posting your query on Microsoft Q&A.

Based on your description, I understand that you want to know if it is possible to make a Verified ID credentials expiration be longer than 6 months, like maybe 12, and also regarding the notifications to employees about the upcoming expiration of their credential and the need to renew.

Firstly, please note that currently there are specifically no settings available in Microsoft Entra ID to increase the Expiration time of Verified ID Credentials from 6 months to 12 months.

But if you have already configured Verifiable Credentials app in App Registrations section in Microsoft Entra ID, then you can increase the Expiration time of the client secret configured for the Verifiable Credentials application by following the below steps.

1. Sign in to the Microsoft Entra admin center as a Global Administrator.
2. Select Microsoft Entra ID.
3. Go to Applications > App registrations page.
4. Select the verifiable-credentials-app application you created earlier.
5. Select the name to go into the registration details.
6. Copy the Application (client) ID, and store it for later.

7. From the main menu, under Manage, select Certificates & secrets.
8. Select New client secret, and do the following:
9. In Description, enter a description for the client secret (for example, vc-sample-secret).
10. Under Expires, select a duration for which the secret is valid (for example, 12 months). Then select Add.
11. Record the secret's Value. You'll use this value for configuration in a later step. The secret’s value won't be displayed again, and isn't retrievable by any other means. Record it as soon as it's visible.

At this point, you should have all the required information that you need to set up your sample application.

For additional details, please refer to the below document for your reference.

https://learn.microsoft.com/en-us/entra/verified-id/verifiable-credentials-configure-issuer#configure-the-verifiable-credentials-app

Also, please note that currently there are no specific options or settings available in Microsoft Entra ID to setup the notifications to the employees about the upcoming expiration of their Verified credentials and the need to renew.

Note:

Your key rotation policy needs to be coordinated with the lifetime of issued Verified ID credentials so that credentials are renewed or reissued before an old key is retired. An example of a solution that doesn't work is issuing Verified ID credentials with an expiration date 12 months away and at the same time having a key rotation policy to rotate keys every month. Such a solution is in trouble the last two months of the year because old keys aren't available anymore.

For additional information, please refer to the below document for your reference.

https://learn.microsoft.com/en-us/entra/verified-id/how-to-rotate-keys

I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks and Regards,

Sanoop Mohan