Token Watch logo Token Watch  Sign In  Sign Up

Token Watch documentation

Everything you need to set up monitoring for your Azure App Registration client secrets and certificates — from connecting a tenant to choosing where the alerts land. Pick a page from the menu on the left, or start with the sections below.

New here? Start with Connect your Microsoft Entra tenant. Setup takes about a minute and needs read-only consent only.

Getting started

Connect your Microsoft Entra tenant

Sign in with Microsoft, grant the read-only consent, and get every App Registration credential in your tenant listed with its expiration date.

How monitoring works

What Token Watch checks on each daily run, how the expiring threshold decides what gets reported, and how tracking controls the noise.

Alerts

Choosing your alert channels

Email always delivers the report; the Team plan adds exactly one more channel — Slack, Microsoft Teams, Azure DevOps, or a signed webhook. What each one delivers and how to choose.

Alerting models: how often you hear about it

Every team runs at its own pace. Three ways to be told a credential is expiring — a short countdown, a daily alert until resolved, and status-transition alerts — compared day by day on one timeline.

Monitoring best practices: track only what matters

Getting the same alert every day? Turn off tracking for credentials you aren't going to rotate, so the daily report lists only the ones that need action.

Step-by-step guides

Channel-specific walkthroughs live on the blog, one per delivery target: email, Slack, Microsoft Teams, Azure DevOps, and the signed JSON webhook. The integrations hub compares them side by side.

Something missing?

If a page here doesn't answer your question, email contact@aztokenwatch.com or use the support page — questions asked there tend to become documentation.

Top