Azure Security

Monitor Your Expired Azure App Certificates

Build an automation account to monitor your Azure App Certificates and get notified before expiration

Eitan Talmi 10 min read Azure, Automation, Certificates

This article will explain how to build an automation account to monitor your Azure App Certificates and to notify you before expiration.

Prepare the Certificates

Step 1: Create Self-Signed Certificate

  1. Open PowerShell window as administrator
  2. Run the following command:
PowerShell 
New-SelfSignedCertificate -Subject 'CN=AzureAppCertsChecker' -KeyLength 2048 -KeyUsageProperty All -KeyAlgorithm 'RSA' -HashAlgorithm 'SHA256' -Provider 'Microsoft Enhanced RSA and AES Cryptographic Provider' -NotAfter (Get-Date).AddYears(10)
  1. Extract the certificate from your computer using MMC
  2. The certificate will be in the personal store; export it twice, one with the private key and one without

Create the App

Azure App Registration Steps

  1. Go to Azure App registrations
  2. Click on New registration, give a name to the application, and click on Register
  3. Click on the app you just created and click on Certificates & secrets
  4. Click on Certificates and then on Upload certificate
  5. Choose the certificate without the private key you exported
  6. Click on API permissions
  7. Click on Add a permission
  8. Click on Microsoft Graph and on Application permissions
  9. Search for mail and under the Mail section check all five
  10. Search for application and check Application.Read.All
  11. Click on Add permissions
  12. Click on Grant admin consent for…
  13. Click on Overview and copy the Application (client) ID and Directory (tenant) ID

Conclusion

You've successfully set up an automated monitoring system for your Azure App certificates. This solution will help you stay ahead of certificate expirations and maintain the security of your Azure applications.

Share this article