Use Azure Logic Apps to Notify of Pending AAD Application Client Secrets and Certificate Expirations

I think I figured this out. I too have been running this for a few months now and recently came across the same issue. It seems the error stems from the logic app reading these Power Apps and seeing an owner of Power Virtual Agents Service and no email address attached to it.

So when the "Send an Email" task runs and pulls in a null value for the "To:" field. You get a bad request/400 status on the task.

1 workaround and 2 ways to fix this;
(Workaround)
1. Find all the (Microsoft Copilot Studio) app registrations with expired certs and delete the expired cert. the logic app won't pick up those up and won't need to email out. It's not a fix but will let the logic app continue through, until the next app expires that have the same owner and no email address.

2. Add a valid owner that has an email address to each of these copilot applications. So that the logic app doesn't try to add a null value in the To: field. I believe this can be done systematically via Entra powershell.

3. Modify the logic app code and add some error/null handling for these types of situations.

I suspect this won't be the first and last time that we see MS add application with owners that don't have an email address. 

Thank you. Really not sure what to show you but from the run details it seems to fail on apps related to "Power Virtual Agents" or "Microsoft Copilot Studio", these names appear in parenthesis on the failed apps. Examples:
Step: "Foreach - apps" (failed) :
Customer Service Copilot Bot (Power Virtual Agents)
Sales Copilot Power Virtual Agents Bot (Power Virtual Agents)
xxxxxxxxxxV2 (Microsoft Copilot Studio)

Step: "For each KeyCred"
ActionFailed
An action failed. No dependent actions succeeded.