Monitor The Azure Active Directory Client Secret Expiration

Enabling Managed Identity in Azure Functions

We would need to enable Managed identity to grant permission to our Azure Function app to access the Active Directory. Please take a look at use managed identities for App Service and Azure Functions to enable it.

How to assign Application administrator permission to Azure Managed identity

• Go to Azure Active Directory and in the landing, page select “Roles and administrators”
  
• In the upcoming screen, select “Application administrator” and then click “Add Assignments”.
  
• Then search your managed identity and grant the permission. After granting permission you can find your Azure function app identity under assignments as below,
  

Now all the perquisites and the setup done for our implementation let’s see the actual script to do that,

PowerShell Code in Azure Function to monitor Azure AD Client Secrets

• Add the expiration days to monitor and Webhook post link in Function App configuration as below, so it can be accessed in the function code.
  
• Now our script will read all the AD apps for which client secrets will expire before the configured timeframe and fetch the meta details like Description, ExpiryDate, AppID, AppObjectID, AppName and Key Identifier.
• Even if there are more than one client secrets are expiring in the same Azure AD app. It will also be returned as a separate object in the resulting array.
• The last few lines of the code will post the Array object to WebHook.
• Here is the full code go to your Timer Trigger Function and click “Code + Test” and replace the code editor with below code

  # Input bindings are passed in via param block.
  param($Timer)
  
  
  #secret expiration date filter (for example 30 days)
  $LimitExpirationDays = $env:LimitExpirationDays
  
  $SecretsToExpire =@()
  
  #Retrieving the list of secrets that expires in the above range of days
  Get-AzADApplication | ForEach-Object {
      $app = $_
      @(
          Get-AzADAppCredential -ObjectId $_.Id
      ) | Where-Object {
          $_.EndDateTime -lt (Get-Date).AddDays($LimitExpirationDays)
      } | ForEach-Object {
           $expiringSecret = @{
              AppName = $app.DisplayName
              AppObjectID = $app.Id
              AppApplicationId = $app.AppId
              SecretDisplayName = $_.DisplayName
              SecretKeyIdentifier = $_.KeyId
              SecretEndDate = $_.EndDateTime
          }
          $SecretsToExpire += $expiringSecret
      }
  }
  
  #Printing the list of secrets that are near to expire
  if($SecretsToExpire.Count -EQ 0) {
      Write-Output "No secrets found that will expire in this range"
  }
  else {
      Write-Output "Secrets that will expire in this range:"
      Write-Output $SecretsToExpire.Length
      Write-Output $SecretsToExpire | ConvertTo-Json
  
      $headers = @{
      'Content-Type' = 'application/json'
      }
  
      if($SecretsToExpire.Length -EQ 1){
      Invoke-RestMethod -Method 'Post' -Headers $headers -Uri $env:LogicApp_API_Url -Body (ConvertTo-Json @($SecretsToExpire))
      }
      else{
      Invoke-RestMethod -Method 'Post' -Headers $headers -Uri $env:LogicApp_API_Url -Body ($SecretsToExpire | ConvertTo-Json)
      }
  }

Now the next step is to send notification to the user, it can be any kind of webhook/API URL which receive your POST call from PowerShell and process the Request data to send emails. You can make this process easier when you go with Azure Logic Apps as it has default connectors for Mailing.

Now our eyes are on the expiring Client Secrets before it expires which monitors it on daily basis.

Note: If you don’t want to receive the emails or run the trigger, go to your Timer Trigger -> Overview page and Disable the Function temporarily.