Client Secret Expiry Monitoring

Overview

This enables customers to track and address expiring secrets in advance.

This enhancement is only available in Applications Manager version 172500 and above.

Table Columns and Data Fields

Note: Client secrets expiring today or already expired will show "0" under Days to Expire. The Status field will indicate whether the secret is expiring today or has already expired.

Data Collection - Permissions and Enablement

Default Status

By default, Client secret expiry monitoring is disabled for both Microsoft 365 and Microsoft Azure monitors. When enabled, it covers:

1. Client secrets that expired in the last 10 days.
   
2. Client secrets expiring in the next 30 days.

Required Permission

To enable Client secret expiry monitoring, customers must:

1. Grant the Application.Read.All permission to the app credentials used in Applications Manager.
2. Manually enable Performance Polling for data collection.

Important:
Performance Polling should be enabled only after granting the required permission.
Enabling polling before providing the correct permission may cause data collection failures. If this happens, customers may need to wait until the next polling cycle (up to 12 hours or the configured interval) to see the data.

Configuring Polling Frequency & Expiry Range

Customers can customize polling frequency and monitoring range under:

Settings → Performance Polling → Optimize Data Collection →  Choose Monitor Type (Microsoft Azure/Microsoft 365)

Polling Frequency

Metric Name: Client Secret Expiry Details.

Options:

• Collect data at default intervals (12 hours) - Recommended
• Collect data at customized intervals - Specify your preferred interval

Note: Polling intervals below 12 hours may cause performance issues. If a lower interval is set, a warning alert will be displayed on the monitor page.

Monitoring Range - Expired and Expiring Secrets

The Day range configuration is only available in Applications Manager version 175400 and above.

Customers can also adjust the date ranges for which secrets are monitored:

Key Takeaways

• Client secret monitoring is disabled by default. Enable it via Performance Polling after granting the required permission.
• The Application.Read.All permission is mandatory to collect data.
• Performance Polling must be enabled only after setting permissions to avoid data collection failures.
• Polling intervals below 12 hours may affect performance trigger a warning.
• Monitoring ranges are customizable from last 1-30 days for expired secrets and next 0-90 days for expiring secrets.