Managing App Registration secrets manually in Azure is risky and inefficient—expired secrets can break integrations, and forgotten ones can create security vulnerabilities.

To solve this, I’ve built and open-sourced a fully automated solution to monitor, rotate, and report on App Registration secrets using native Azure services like Automation Account, Key Vault, Log Analytics, and Storage Account.

👉 GitHub repository:
https://github.com/net9876/azure-appreg-secrets-ops

✅ What It Does

This solution provides complete lifecycle management of App Registration secrets:

🔍 Daily Monitoring

• Scans all App Registrations in your tenant.
• Categorizes secrets as:
  • Expired
  • ExpiringSoon (≤15 days)
  • Good (16–180 days)
  • TooLongExpiration (>180 days)
• Logs only ExpiringSoon secrets to Log Analytics for alerting.
• Uploads full CSV reports daily to a Storage Account.

🔁 Automatic Rotation

• If a secret is expiring in 30 days, a new one is created automatically.
• The new secret is:
  • Stored securely in Azure Key Vault.
  • Logged to Log Analytics (rotation log).
  • Used to trigger notifications (and potentially tickets or workflows).

📊 Alerts

• Two Azure Monitor Alerts are deployed:
  • AppRegistrationSecretExpiryNotice – warns if a secret is within 15 days of expiry.
  • AppRegistrationSecretRotationNotice – confirms successful secret rotation at 30 days.

🛠️ Technologies Used

• Azure Automation Account (with Managed Identity)
• Azure Key Vault
• Log Analytics Workspace (custom logs)
• Storage Account (for CSV exports)
• PowerShell scripts (fully parameterized)
• Azure Monitor Alerts
• ARM & Terraform-ready structure

🚀 Quick Start

Deploy with a single command:

powershellCopyEdit.\deploy\deploy.ps1 -SubscriptionId "<your-subscription-id>" -ProjectPrefix "myproject"

Or in Bash:

bashCopyEdit./deploy/deploy.sh <your-subscription-id> myproject

Customize the project prefix and permissions as needed.

📁 Outputs

• CSV Reports with daily status (path: AppSecretsReport_YYYYMMDD_HHMMSS.csv)
• Custom Logs in Log Analytics:
  • AppSecretExpiry_CL
  • AppSecretRotation_CL

🔓 Why This Matters

This is a production-ready automation pattern designed for enterprises, consultants, and individual Azure tenants who need:

• Better security governance
• Automatic remediation
• Audit-ready logging and reporting

You’ll never be surprised by an expired App Registration secret again.

🔗 Source Code and Documentation

👉 Visit the GitHub repo:
https://github.com/net9876/azure-appreg-secrets-ops

The repo includes:

• Full README.md with architecture diagram
• Deployment scripts (PowerShell & Bash)
• Automation runbooks
• Monitoring & alerting setup

💡 Have questions or want to contribute? Feel free to open an issue or fork the repo!