Key Vault Expiry Digest — Keys, Secrets & Certificates

WHAT IT DOES

Key Vault Expiry Digest deploys into your own Azure subscription as a managed application. Every day it enumerates every Key Vault in the subscription and reports, in one Microsoft Teams digest, the keys, secrets, and certificates that are expired, expiring within your thresholds (re-reported daily so it escalates), or have no expiry set at all. It reads object metadata through the ARM management plane only — never secret values or key material.

WHO IT IS FOR

Security, identity, and platform teams who run more vaults and certificates than they can track by hand — and anyone who has been paged for an outage that turned out to be an expired certificate.

WHY IT IS SAFE

There is no vendor backend. It runs on a consumption Function inside your subscription, uses a read-only Key Vault Reader managed identity you control, and sends the digest only to the Teams webhook you configure. Delete the managed application and every trace is gone.

SETUP

Deploy from the marketplace, paste a Teams webhook URL, and run one script to grant the managed identity Key Vault Reader. The first digest arrives the next morning.