Token Watch
What data Token Watch holds
Updated September 7, 2026
Every field Token Watch reads from Microsoft Graph, every field it writes to its own database, the data it never receives, and how long each category is retained.
Read from Microsoft Graph
The Graph response for an App Registration carries more than Token Watch uses. Only the fields below are deserialised; the rest is discarded during response parsing and never reaches application code.
| Field | Contents |
|---|---|
id, appId | Object id and application (client) id of the App Registration. |
displayName | App Registration name as shown in the portal. |
createdDateTime | Creation timestamp of the App Registration. |
passwordCredentials[] | Per client secret: keyId, displayName, startDateTime, endDateTime. secretText is not read; Graph returns it as null regardless. |
keyCredentials[] | Per certificate: keyId, customKeyIdentifier (thumbprint), displayName, startDateTime, endDateTime. key, the public certificate blob, is not read. |
owners[].id | Directory object id of each owner. Owner names and email addresses are not requested; the id is sufficient to match an owner to a Token Watch user for scoping. |
Stored in the database
Token Watch keeps its state in a single Azure SQL database, in four categories.
1. Tenant and identity
| Stored | Source |
|---|---|
| Entra tenant id | Sign-in token |
Per user: email address, Entra object id (oid), role, status, created / updated / last-login timestamps | Sign-in token |
| Consent state, timestamp of last consent check, timestamp of last sync | Generated |
No password, password hash, MFA state or authentication secret. Sign-in is Entra ID SSO; Token Watch validates the Microsoft-issued token and handles no credentials.
2. Credential inventory
| Stored | Source |
|---|---|
| Per App Registration: display name, application id, creation date, last-checked timestamp, monitoring on/off | Microsoft Graph |
| Per credential: identifier (key id for a secret, thumbprint for a certificate), display name, type, start date, expiry date, tracked on/off | Microsoft Graph |
| Per App Registration: directory object ids of its owners | Microsoft Graph |
One uploaded certificate can appear in Graph as several entries sharing a thumbprint. Token Watch collapses them into a single tracked credential and stores the thumbprint as its identifier. A thumbprint is a fingerprint of the public certificate, not key material.
3. Configuration
| Stored | Source |
|---|---|
| Monitoring settings: expiring-soon threshold, expired-credential lookback, reporting on/off | You |
| Alert recipients: the email addresses configured for reports and expired-credential alerts | You |
| Webhook configuration, if enabled: HTTPS endpoint URL, channel format, and a per-tenant HMAC signing secret | You / generated |
| Azure DevOps configuration, if connected: organisation, project name and id, work item type, tags, assignee email address | You |
| Billing: billing email, and the customer and subscription identifiers issued by Paddle or Microsoft Marketplace | You / payment provider |
The webhook signing secret is displayed once, at generation or rotation, and is never returned by the API or written to logs afterwards. No payment card number reaches Token Watch; see subprocessors.
4. Operational history
| Stored | Source |
|---|---|
| Reports: one per tenant per day, the credentials covered, the recipients, per-channel delivery timestamps | Generated |
| Audit log: changes to tracking, monitoring, users, roles, reporting settings, webhook configuration and the Azure DevOps connection, with actor and timestamp | Generated |
| Webhook delivery records: one per delivery attempt, with outcome | Generated |
| Azure DevOps work item links: work item id and URL per credential | Generated |
| Application logs: timestamps, request paths, tenant ids, error traces | Generated |
Related
- Permissions and Graph access — how this data is obtained.
- Retention and deletion — how long each category above is kept.
- Architecture, hosting and encryption — where it is stored and how it is protected.
- Privacy policy — the legal statement covering the same ground.