Token Watch
by Maksym Vostruhin
Monitor Microsoft Entra app secrets and certificates before they expire.
Token Watch monitors Microsoft Entra ID (Azure AD) app registration secrets and certificates and alerts your team before an expired credential breaks production.
Use Token Watch to:
See expired, expiring, healthy Entra application credentials in one tenant-wide view.
Track important secrets and certificates, while ignoring credentials that do not need monitoring.
Receive scheduled email reports for credentials that need attention.
Send alerts to Slack, Microsoft Teams through Power Automate, or custom HTTPS webhooks.
Give teammates role-based access without granting anyone Entra admin rights — every tracking and settings change is audit-logged.
Automatically turn expired or expiring credentials into Azure DevOps work items, so renewal work is assigned and tracked.
Token Watch connects with Microsoft identity and uses Microsoft Graph to read application registration metadata. It stores operational metadata such as application names, client IDs, credential display names, creation dates, and expiry dates. Token Watch does not read or store secret values, certificate private keys, Microsoft passwords, or payment card details.