Token Watch
Connect your Microsoft Entra tenant
Updated August 21, 2026
Token Watch reads your tenant through Microsoft Graph. There is nothing to install, no agent to run, and no script to keep alive — you sign in with your Microsoft account, grant a read-only consent once, and Token Watch lists every App Registration in the tenant with the expiration date of each client secret and certificate.
Before you start
- You need an account in the Microsoft Entra ID tenant you want to monitor.
- The consent covers the whole tenant, so it has to be granted by someone who can approve application permissions — typically a Global Administrator or a Privileged Role Administrator. If that isn't you, send them the consent link and have them approve it.
- No firewall changes, no network access into your environment, and no credentials to store.
Connect the tenant
- Open app.aztokenwatch.com and sign in with Microsoft.
- Review the permission prompt. Token Watch asks for
Application.Read.All— read-only access to App Registration metadata — plus basic sign-in and profile scopes. - Accept the consent. Entra returns you to Token Watch and the first scan starts immediately.
- Your App Registrations appear in the list, each with its credential names, key IDs, and expiration dates.
If the consent screen says an administrator must approve the request, your account can't grant
tenant-wide consent. Ask an administrator to complete the sign-in once — after that,
everyone in the tenant can sign in normally.
What Token Watch can and can't see
The consent is read-only, so Token Watch cannot create, change, or delete anything in your tenant. What it reads is metadata:
- It reads: application name and ID, credential display name, key ID, credential type (client secret or certificate), and start and expiry dates.
- It never sees secret values or certificate private keys. Microsoft Graph does not return the value of a client secret after it is created — not to Token Watch, not to anyone.
- It doesn't store your credentials. Sign-in is handled by Microsoft Entra ID single sign-on.
The full details are in the privacy policy.
Next steps
- How monitoring works — the daily check, the expiring threshold, and how to keep the alerts focused.
- Choosing your alert channels — where the alerts should land.