Token Watch
There are six realistic ways to get a warning before that happens. One is built into Entra, and one is a script you run yourself. Three are platforms that include an expiry check among many other features, and Token Watch is built for this alone.
We make Token Watch. The other five are described from Microsoft's and each vendor's own documentation and pricing pages, checked on 4 November 2026.
The comparison
| Option | What it is | Runs where | Alerts go to | Warning window | Price we found |
|---|---|---|---|---|---|
| Entra recommendation | Built into Entra ID, preview | Microsoft | Admin center, plus one preview email to the Application Administrator role | Fixed at 30 days | Part of Entra ID |
| A Graph script ours is free on GitHub |
DIY | Your Automation account, Function or server | Whatever you build, usually email | Whatever you code | Free, plus your time |
| Checkmk | Infrastructure monitoring | Your Checkmk server | Your existing Checkmk notifications | WARN at 30 days, CRIT at 7 by default | Included in all editions |
| CoreView | Microsoft 365 management platform | CoreView | Scheduled email report to a recipient you set | 30, 60 or 90 days | Not published |
| Turbo360 | Azure monitoring and FinOps platform | Turbo360 | Turbo360 notification channels (Teams, Slack, ServiceNow, PagerDuty, Opsgenie and others) | Days you set per app or profile | Quote-based; 14-day trial |
| Token Watch | Hosted service for app registration expiry | Token Watch | Email; Team plan adds Microsoft Teams, Slack, Azure DevOps work items or a signed webhook | 3 business days on Free; 1 to 120 days on paid plans | Free; $29 or $59 per month |
All six cover both client secrets and certificates on app registrations. They differ on who gets the alert, which permission they need, and where the data ends up.
Built into Entra
1. The “Renew expiring application credentials” recommendation
Entra's recommendations page flags app registration credentials that expire within the next 30 days. It's a preview feature, and the 30 days can't be changed. When the recommendation is first generated, a preview email goes to users with the Application Administrator role. If you use Privileged Identity Management, only people with that role active at the time get it, and if nobody holds the role actively, no email goes out. After that one email, you have to open the page to see what's expiring.
Best fit: a backstop for any tenant, and enough on its own if someone opens the recommendations page every week.
Free, and you run it
2. A script on a schedule (ours is free on GitHub)
Microsoft Graph returns every app registration with its passwordCredentials and
keyCredentials, and each one has an endDateTime. A PowerShell or Python
script that reads those, filters by date and sends an email is an afternoon's work. Running it
unattended takes longer: it needs its own sign-in, a schedule in Azure Automation, a Function or Task
Scheduler, and somewhere to send results.
The two failure modes worth planning for are the schedule stopping without anyone noticing, and the script's own credential expiring. A run that never happened sends no email, and neither does a run that found nothing.
You don't have to start from a blank file. Our free, open-source script is on GitHub: github.com/Vostrugin/entra-app-registration-expiry-check. It covers the awkward parts. It signs in with a managed identity, a federated token or a certificate, so it has no secret of its own to expire. It reads certificates as well as secrets, takes an exclusions file, and returns different exit codes for “the check failed” and “the check found something”. The DIY section of how to get notified before a secret expires covers the trade-offs.
Best fit: one admin who lives in PowerShell and only needs email.
Included in a platform you may already have
3. Checkmk
If you run Checkmk, its Azure special agent includes an
azure_v2_app_registration check,
with one service per secret. The defaults are WARN at 30 days and CRIT at 7, and the same rule can also
warn when a secret's total lifetime is longer than you allow. Certificates get a separate check. A
recent change added an “Ignore if older than” option, so secrets that expired years ago
stop showing up as critical. Checkmk says the check is in all editions.
Alerts go through whatever Checkmk notification rules you already have.
Best fit: teams already on Checkmk. It's a lot to install for this one check.
4. CoreView
CoreView is a Microsoft 365 management platform. Its App secrets report lists every app registration secret with its expiry date and days remaining. Its Entra app policies can email a scheduled report of secrets or certificates expiring in the next 30, 60 or 90 days to a recipient you choose. Other policies in the same set flag credentials that have already expired, and ones that live longer than 180 days. CoreView doesn't publish prices.
Best fit: Microsoft 365 teams that already use CoreView for licensing, delegation or reporting.
5. Turbo360
Turbo360 (from Kovai) is an Azure monitoring and cost platform. You add app registrations to a
business application, set how many days before expiry to alert, and use monitoring profiles to apply
the same settings across many apps. Its
docs
ask for Application.Read.All in Entra ID. Alerts go to Turbo360's notification channels,
which include Microsoft Teams, Slack, ServiceNow, PagerDuty and Opsgenie.
Pricing is quote-based, through Azure Marketplace private offers, with a 14-day trial.
Best fit: teams that already monitor Azure integration and serverless resources in Turbo360.
Built for this one job
6. Token Watch
Token Watch is ours. It's a hosted service that reads app registrations with one read-only Graph
permission, Application.Read.All, and checks them once a day. It never receives secret
values, only names, IDs and expiry dates.
The Free plan covers 100 app registrations and emails one recipient, starting three business days before a credential expires and repeating daily until it's rotated. Starter ($29 a month) covers 200 app registrations, sends to multiple recipients and lets you set the warning window anywhere from 1 to 120 days. Paid plans can also notify each app's owners. You can buy through the Microsoft Marketplace.
Team ($59 a month) covers 400 app registrations and adds one integration on top of email:
- Microsoft Teams: an Adaptive Card for each expiring credential, posted to the channel or chat you choose through a Power Automate workflow.
- Slack, through an incoming webhook.
- Azure DevOps: one work item per credential, closed automatically after rotation.
- A signed JSON webhook for PagerDuty, ServiceNow, Opsgenie or your own API.
Best fit: teams that want alerts to reach the app's owners, or land in Teams, Slack or Azure DevOps, and want to start free.
What to check before you pick one
- What it reads. App registrations only, or also service principals and SAML certificates on enterprise apps?
- Which permission it asks for.
Application.Read.Allis enough to read credential metadata on app registrations. Anything broader should come with a reason. - Where the data goes. A script and Checkmk keep it in your environment. CoreView, Turbo360 and Token Watch are hosted by the vendor, so ask which region.
- How the monitor signs in. A monitor you host that uses a client secret has an expiry date of its own. A managed identity, a federated credential or a certificate avoids that. Either way, make sure the monitor watches its own app registration.
- Who gets the alert. One admin role, a list of addresses, or the people who own each app.
- What happens when the check fails. A schedule that stopped looks the same as a tenant with nothing expiring, unless something reports the missed run.
- What the price covers. CoreView and Turbo360 quote per customer and bundle many other features. Token Watch charges by the number of app registrations. A script and Checkmk cost what you already pay to run them, plus your time.
About SAML certificates
SAML signing certificates on enterprise applications are a separate case. Entra already emails up to five notification addresses 60, 30 and 7 days before one expires. By default the only address is the admin who added the app, so add your team's addresses on each app's Single sign-on page. For more than five people, use a distribution list.