App Registration Expiration Monitoring and Notifications

Published 01-11-2021 12:01 AM 4,132 Views

 

 

Pic1

Problem Statement 

Azure services do not have a native feature to report on expiring App registrations. Without a solution in place to monitor and notify on expiration of these SPN’s solutions ranging from Custom Apps, and DevOps CI\CD Pipelines too orchestration engines like Azure Automation and Logic Apps, can and will cease to function without notice. 

  • Purpose of this solution: To provide an automated mechanism of calculating and ingesting the expiration dates into Log Analytics and automatically notify resources when expiration is within threshold. 
  • Requisites: This solution consists of: 
  • 1 Runbook consisting of the PowerShell script in this document. 
  • 2 Automation Variables containing the Log Analytics Workspace ID and the Log Analytics Primary Key. 
  • 1 SPN in the monitored cloud environment with Global Reader role. 

Solution Overview 

The solution is designed to be cross tenant and requires an App Registration\SPN in the desired environment with Global Reader rights. Utilizing Azure Automation (AA) and AA resources like Variables and Credentials our runbook pulls an array of SPN’s from the environment and calculates the time until expiration before using our custom function to send the data to a Log Analytics Workspace. Finally, Azure Monitor alerts can be triggered based on a Kusto query to notify resources that there are SPN’s within the threshold for expiration. 

 

Where can I get this solution? 

The solution is documented in detail on my GitHub repo and available for consumption immediately. 
https://github.com/Cj-Scott/Get-AppRegistrationExpiration 

8 Comments
Occasional Visitor
OK
Occasional Visitor

Hi Christopher,

you've linked to web.archive.org in your link to your github repo.

 

Cheers

Raffael

Frequent Visitor

This looks like an awesome solution and exactly what we need ... trying it out now!

 
 

 

 

Microsoft
Frequent Visitor

Nice @Russ Rimmerman in some ways your solution is better ... I like the email formatting at the end!

 

Currently running with the solution described above but may end up using both solutions ... the solution above can be used to generate a ServiceNow ticket when a App Registration is due to expire exactly 30 days from now.  The Power Automate solution can be used to generate a tidy "Report" ... great stuff guys!

 

Occasional Visitor

Hi all,

 

Is this working with multiple Subscriptions on the tenant?

 

KR,

 

Noâm

 

Microsoft

@Skywalker The Power Automate solution could also be used to generate a ServiceNow ticket when an app registration is due 30 days from now as well - Power Automate has a ServiceNow connector.

@nono7390 Yes it shoudl work across multiple subscriptions. It can also work across multiple tenants and environments but would require multiple runbooks and SPN's with the required permissions.

%3CLINGO-SUB%20id%3D%22lingo-sub-2043805%22%20slang%3D%22en-US%22%3EApp%20Registration%20Expiration%20Monitoring%20and%20Notifications%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2043805%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20size%3D%225%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Pic1%22%20style%3D%22width%3A%20741px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244903i05488B278DBAD676%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Pic1%22%20alt%3D%22Pic1%22%20%2F%3E%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20size%3D%225%22%3EProblem%20Statement%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EAzure%20services%20do%20not%20have%20a%20native%20feature%20to%20report%20on%20expiring%20App%20registrations.%20Without%20a%20solution%20in%20place%20to%20monitor%20and%20notify%20on%20expiration%20of%20these%20SPN%E2%80%99s%20solutions%20ranging%20from%20Custom%20Apps%2C%20and%20DevOps%20CI%5CCD%20Pipelines%20too%20orchestration%20engines%20like%20Azure%20Automation%20and%20Logic%20Apps%2C%20can%20and%20will%20cease%20to%20function%20without%20notice.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%221%22%20data-aria-level%3D%221%22%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EPurpose%20of%20this%20solution%3A%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%E2%80%AFTo%20provide%20an%20automated%20mechanism%26nbsp%3Bof%26nbsp%3Bcalculating%20and%20ingesting%20the%20expiration%20dates%20into%20Log%20Analytics%20and%20automatically%20notify%20resources%20when%20expiration%20is%20within%20threshold.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CUL%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%221%22%20data-aria-level%3D%221%22%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3ERequisites%3A%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%E2%80%AFThis%20solution%20consists%20of%3A%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CUL%3E%0A%3CLI%20data-leveltext%3D%22o%22%20data-font%3D%22Courier%20New%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%221%22%20data-aria-level%3D%222%22%3E%3CSPAN%20data-contrast%3D%22none%22%3E1%20Runbook%20consisting%20of%20the%20PowerShell%20script%20in%20this%20document.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22o%22%20data-font%3D%22Courier%20New%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%222%22%20data-aria-level%3D%222%22%3E%3CSPAN%20data-contrast%3D%22none%22%3E2%20Automation%20Variables%20containing%20the%20Log%20Analytics%20Workspace%20ID%20and%20the%20Log%20Analytics%20Primary%20Key.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22o%22%20data-font%3D%22Courier%20New%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%223%22%20data-aria-level%3D%222%22%3E%3CSPAN%20data-contrast%3D%22none%22%3E1%20SPN%20in%20the%20monitored%20cloud%20environment%20with%20Global%20Reader%20role.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CFONT%20size%3D%225%22%3E%3CSPAN%20data-contrast%3D%22none%22%3ESolution%20Overview%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EThe%20solution%20is%20designed%20to%20be%20cross%20tenant%20and%20requires%20an%20App%20Registration%5CSPN%20in%20the%20desired%20environment%20with%20Global%20Reader%20rights.%20Utilizing%20Azure%20Automation%20(AA)%20and%20AA%20resources%20like%20Variables%20and%20Credentials%20our%20runbook%20pulls%20an%20array%20of%20SPN%E2%80%99s%20from%20the%20environment%20and%20calculates%20the%20time%20until%20expiration%20before%20using%20our%20custom%20function%20to%20send%20the%20data%20to%20a%20Log%20Analytics%20Workspace.%20Finally%2C%20Azure%20Monitor%20alerts%20can%20be%20triggered%20based%20on%20a%20Kusto%20query%20to%20notify%20resources%20that%20there%20are%20SPN%E2%80%99s%20within%20the%20threshold%20for%20expiration.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3E%E2%80%AF%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20size%3D%225%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EWhere%20can%20I%20get%20this%20solution%3F%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EThe%20solution%20is%20documented%20in%20detail%20on%20my%20GitHub%20repo%20and%20available%20for%20consumption%20immediately.%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fweb.archive.org%2Fweb%2F20201210220930%2Fhttps%3A%2Fgithub.com%2FCj-Scott%2FGet-AppRegistrationExpiration%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Ehttps%3A%2F%2Fgithub.com%2FCj-Scott%2FGet-AppRegistrationExpiration%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A150%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2043805%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Pic1%22%20style%3D%22width%3A%20741px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F244904i7C53E84BDDAAF833%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Pic1%22%20alt%3D%22Pic1%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EUtilizing%20a%20suite%20of%20Azure%20services%20we%20pull%20an%20array%20of%20SPN%E2%80%99s%20from%20the%20environment%20and%20calculate%20the%20time%20until%20expiration%20before%20sending%20the%20data%20to%20a%20Log%20Analytics%20Workspace.%20Finally%2C%20Azure%20Monitor%20alerts%20can%20be%20triggered%20based%20on%20a%20Kusto%20query%20to%20notify%20resources%20that%20there%20are%20SPN%E2%80%99s%20within%20the%20threshold%20for%20expiration.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2043805%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EChristopherScott%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2059868%22%20slang%3D%22de-DE%22%3ERE%3A%20App%20Registration%20Expiration%20Monitoring%20and%20Notifications%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2059868%22%20slang%3D%22de-DE%22%3EOk%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2097782%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Registration%20Expiration%20Monitoring%20and%20Notifications%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2097782%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Christopher%2C%3C%2FP%3E%3CP%3Eyou've%20linked%20to%20web.archive.org%20in%20your%20link%20to%20your%20github%20repo.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECheers%3C%2FP%3E%3CP%3ERaffael%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2394406%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Registration%20Expiration%20Monitoring%20and%20Notifications%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2394406%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20looks%20like%20an%20awesome%20solution%20and%20exactly%20what%20we%20need%20...%20trying%20it%20out%20now!%3C%2FP%3E%3CDIV%20class%3D%22fxc-weave-pccontrol%20fxc-section-control%20fxc-base%20msportalfx-customHtml%20msportalfx-form-formelement%22%3E%3CDIV%20class%3D%22azc-formElementSubLabelContainer%22%3E%3CDIV%20class%3D%22azc-formElementContainer%22%3E%3CDIV%20class%3D%22msportalfx-text-header-label%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2408798%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Registration%20Expiration%20Monitoring%20and%20Notifications%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2408798%22%20slang%3D%22en-US%22%3E%3CP%3EOh%20man%2C%20looks%20like%20I%20may%20have%20reinvented%20the%20wheel%20%3A)%3C%2Fimg%3E%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fcore-infrastructure-and-security%2Fuse-power-automate-to-notify-of-upcoming-azure-ad-app-client%2Fba-p%2F2406145%22%20target%3D%22_blank%22%3EUse%20Power%20Automate%20to%20Notify%20of%20Upcoming%20Azure%20AD%20App%20Client%20Secrets%20and%20Certificate%20Expirations%20-%20Microsoft%20Tech%20Community%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2410593%22%20slang%3D%22en-US%22%3ERe%3A%20App%20Registration%20Expiration%20Monitoring%20and%20Notifications%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2410593%22%20slang%3D%22en-US%22%3E%3CP%3ENice%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F237860%22%20target%3D%22_blank%22%3E%40Russ%20Rimmerman%3C%2FA%3E%26nbsp%3Bin%20some%20ways%20your%20solution%20is%20better%20...%20I%20like%20the%20email%20formatting%20at%20the%20end!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECurrently%20running%20with%20the%20solution%20described%20above%20but%20may%20end%20up%20using%20both%20solutions%20...%20the%20solution%20above%20can%20be%20used%20to%20generate%20a%20ServiceNow%20ticket%20when%20a%20App%20Registration%20is%20due%20to%20expire%20exactly%2030%20days%20from%20now.%26nbsp%3B%20The%20Power%20Automate%20solution%20can%20be%20used%20to%20generate%20a%20tidy%20%22Report%22%20...%20great%20stuff%20guys!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Version history
Last update:
‎May 28 2021 07:34 AM