Microsoft Entra recommendation: Renew expiring application credentials (preview)
Microsoft Entra recommendations is a feature that provides you with personalized insights and actionable guidance to align your tenant with recommended best practices.
This article covers the recommendation to renew expiring application credentials. This recommendation is called applicationCredentialExpiry in the recommendations API in Microsoft Graph.
Prerequisites
There are different role requirements for viewing or updating a recommendation. Use the least-privileged role for the type of access needed. For a full list of roles, see Least privileged roles by task.
| Microsoft Entra role | Access type |
|---|---|
| Reports Reader | Read-only |
| Security Reader | Read-only |
| Global Reader | Read-only |
| Authentication Policy Administrator | Update and read |
| Exchange Administrator | Update and read |
| Security Administrator | Update and read |
DirectoryRecommendations.Read.All |
Read-only in Microsoft Graph |
DirectoryRecommendations.ReadWrite.All |
Update and read in Microsoft Graph |
Some recommendations might require a P2 or other license. For more information, see Recommendation availability and license requirements.
Description
Application credentials can include certificates and other types of secrets that need to be registered with that application. These credentials are used to prove the identity of the application.
This recommendation shows up if your tenant has application credentials that will expire soon.
An application credential is expiring if:
- It's on an application registration AND is expiring within the next 30 days.
The following credentials are exempted from this recommendation:
- Credentials that were identified as expiring but have since been removed from the app registration
- Credentials whose expiration date has lapsed show as completed in the list of Impacted resources.
Value
Renewing an application’s credentials prior to their expiry date is crucial for maintaining uninterrupted operations and minimizing the risk of any downtime resulting from outdated credentials.
Action plan
This recommendation is available in the Microsoft Entra admin center and using the Microsoft Graph API.
Sign in to the Microsoft Entra admin center as at least a Security Administrator.
Browse to Identity > Overview.
Select the Recommendations tab and select the Renew expiring application credentials recommendation.
Take note of the following details from the Impacted resources table.
The Resource column displays the application name
The ID column displays the application ID
Select More Details from the Actions column.
From the panel that opens, select Update Credential to navigate directly to the Certificates & secrets area of the app registration to renew the expiring credential.
- Alternatively, browse to Identity > Applications > App registrations and locate the application for which the credential needs to be rotated.
- Navigate to the Certificates & Secrets section of the app registration.
Pick the credential type that you want to rotate and navigate to either Certificates or Client Secret tab and follow the prompts.
Once the certificate or secret is successfully added, update the service code to ensure it works with the new credential and doesn't negatively affect customers.
Use the Microsoft Entra sign-in logs to validate that the Key ID of the credential matches the one that was recently added.
After validating the new credential, navigate back to App registrations > Certificates and Secrets for the app and remove the old credential.
