Token Watch logo Token Watch  Sign In  Sign Up

How monitoring works

Updated August 21, 2026

Once a tenant is connected, Token Watch re-reads it on a schedule and reports what is expired or about to expire. Three things decide what you actually receive: the daily run, the expiring threshold, and which credentials you're tracking.

The daily run

Token Watch checks your tenant once a day and sends a daily report of everything expired and expiring. The run happens overnight — around 02:00 UTC — so the report is waiting when the working day starts.

A run that finds nothing sends nothing. Quiet days produce no email, no chat message, no webhook call, and no work items. An alert in your inbox always means there is something to act on.

The expiring threshold

The threshold is how far ahead you want to know. A credential enters the report once its expiry date falls inside that window, and stays in every following report until it's rotated or you stop tracking it.

  • Free plan: alerts start three business days before a credential expires, repeat each business day, and one final alert lands once it has expired.
  • Paid plans: the threshold is configurable from 1 to 120 days, and the daily report keeps arriving until the credential is rotated.

One threshold drives every channel: the same setting decides when a credential shows up in email reports, Slack and Teams messages, webhook payloads, and Azure DevOps work items. Pick a window that matches how long a rotation actually takes in your organisation — if a change needs a ticket and a release, 3 days is not enough runway.

Tracking: keeping the report focused

Most tenants contain App Registrations nobody intends to rotate — abandoned experiments, third-party apps, registrations owned by another team. Reporting on those trains people to ignore the alert.

Tracking is per credential. Stop tracking one and it disappears from every channel while staying visible in the inventory, so you can still see it without being alerted about it. Turn tracking back on at any time.

A good first pass: connect the tenant, look at everything expiring in the next few months, and stop tracking whatever your team doesn't own. What's left is your real rotation workload.

What's in an alert

Every channel carries the same metadata — application name, credential name, status, and expiry date — along with a link to Azure so you can jump straight to the credential and rotate it. Secret values and certificate private keys are never included, because Token Watch never receives them.

Next steps

Top