App Registration Expiration Monitoring and Notifications

by | Jan 11, 2021 | Technology | 0 comments

This article is contributed. See the original author and article here.

App Registration Expiration Monitoring and Notifications


Pic1


Problem Statement 


Azure services do not have a native feature to report on expiring App registrations. Without a solution in place to monitor and notify on expiration of these SPN’s solutions ranging from Custom Apps, and DevOps CICD Pipelines too orchestration engines like Azure Automation and Logic Apps, can and will cease to function without notice. 



  • Purpose of this solution: To provide an automated mechanism of calculating and ingesting the expiration dates into Log Analytics and automatically notify resources when expiration is within threshold. 



  • Requisites: This solution consists of: 



  • 1 Runbook consisting of the PowerShell script in this document. 

  • 2 Automation Variables containing the Log Analytics Workspace ID and the Log Analytics Primary Key. 

  • 1 SPN in the monitored cloud environment with Global Reader role. 


Solution Overview 


The solution is designed to be cross tenant and requires an App RegistrationSPN in the desired environment with Global Reader rights. Utilizing Azure Automation (AA) and AA resources like Variables and Credentials our runbook pulls an array of SPN’s from the environment and calculates the time until expiration before using our custom function to send the data to a Log Analytics Workspace. Finally, Azure Monitor alerts can be triggered based on a Kusto query to notify resources that there are SPN’s within the threshold for expiration. 


  


Where can I get this solution? 


The solution is documented in detail on my GitHub repo and available for consumption immediately. 
https://github.com/Cj-Scott/Get-AppRegistrationExpiration 

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Submit a Comment