Security at Token Watch

This section desctibes what Token Watch can reach in your tenant, what it stores, how long it keeps it, where it runs, and which third parties are involved.

Summary

Permission requested	`Application.Read.All` (application permission), plus the standard OpenID Connect sign-in scopes. Granted once by an administrator through Microsoft’s admin-consent screen.
Microsoft Graph calls	One: `GET /v1.0/applications`, plus the paging links Graph returns for it.
Write access	None. No permission is held that can create, modify or delete anything in your tenant.
Secret values	Never received. Graph does not return a client secret’s value after creation, to any caller.
Certificate private keys	Never received. Private keys are not held in an App Registration. The public certificate blob is present in the Graph response and is not deserialised.
Software in your environment	None. No agent, no service account, no inbound connection, no firewall or allow-list change.
What is stored	Credential metadata: application name and id, credential name, key id, type, start and expiry dates. Also your configuration, Token Watch users and operational history. Full field list.
Storing no inventory	No-persistence mode stores only opaque identifiers, with no names, dates or owners, and reads the rest live from Graph. Arranged per tenant.
Where it runs	Azure App Service, Azure Functions and Azure SQL Database, in the United States. EU-located infrastructure is available for enterprise customers. Architecture and data location.
Certifications	None. No SOC 2 or ISO 27001. What is in place instead.
Revocation	Delete the Token Watch enterprise application in your tenant. Access stops at the next token request, with no action needed from us. Revoking access.

Detail

Access and permissions

Permissions and Microsoft Graph access

The permissions requested, why the Graph read uses an application permission, the single endpoint called, what the grant cannot do, and how to revoke it.

Revoking access

How to withdraw consent, what stops the moment you do, and why revocation on its own does not erase data already stored.

Data and infrastructure

What data Token Watch holds

Every field read from Microsoft Graph, every field written to the database, what is never received, and retention and deletion terms.

Retention and deletion

How long each category of data is kept, how to have a tenant erased, and what persists in backups after deletion.

No-persistence mode

An option that stores no application names, expiry dates or owners — only opaque identifiers — and reads everything else live from Microsoft Graph.

Architecture, hosting and encryption

Data flow, Azure components and data location, encryption in transit and at rest, tenant isolation, and controls on customer-supplied outbound endpoints.

Subprocessors

Every third party that processes data on Token Watch's behalf, what each receives, and which are optional destinations you enable.

Governance

Certifications and security controls

Token Watch holds no SOC 2 or ISO 27001. The control areas those audits examine, what is implemented for each, and where it is documented.

Security contact, incidents and legal documents

Vulnerability reporting and response targets, incident notification terms, certification status, and where to find the legal documents.

Why the access is this narrow

Token Watch answers one question about your tenant: which App Registration client secrets and certificates are about to expire. Entra ID does not warn before one lapses, and the workload using it stops authenticating when it does.

Answering that question needs no write access, no secret values, and no directory data beyond the App Registrations themselves, so none of it is requested. Anything not required to answer it is outside the consent.

Questions not covered here

Send them to contact@aztokenwatch.com. Answers come from the engineer who wrote the code. Vulnerability reports and incident contacts are on the contact page.