Your app registrations expire.
Usually on a Saturday.

This watches the client secrets and certificates of your Entra ID app registrations and reports how many days each one has left, as PRTG XML, JSON and a small web page. One container, read-only, every tenant you look after.

$ docker compose up -d

Get it on GitHub Which flavour do I need?

The problem

Nothing tells you in time

A secret quietly reaches its last day and the thing it powered stops: directory sync, a backup job, a signing flow. The error you get points at the symptom, never at the credential.

24 months

is the longest life Entra grants a client secret. Certificates last longer, which only means the surprise arrives later.

One mail

Microsoft sends a digest to the app owner. Owners leave, shared mailboxes get filtered, and nobody notices the gap.

Per tenant

The portal shows one directory at a time. Looking after twelve customers means twelve logins and no shared view.

Web view listing two tenants with their credentials, each showing days remaining, expiry date, type and application name. The shortest runtime is highlighted in red. — Every tenant on one page, sorted by urgency. Numbers below the warning threshold turn orange, below the error threshold red.

Monitoring

It speaks PRTG natively

Point an HTTP Data Advanced sensor at the endpoint and you get one channel per application plus three summary channels, with the warning and error limits already set. No script, no scheduled task, no return-code parsing.

<!-- /prtg?tenant=contoso -->
<prtg>
  <result>
    <channel>Minimale Restlaufzeit</channel>
    <value>4</value>
    <customunit>Tage</customunit>
    <limitminwarning>30</limitminwarning>
    <limitminerror>14</limitminerror>
  </result>
  <!-- one channel per application -->
</prtg>

What the sensor shows

4 dSVC-Backup-Veeam
19 dSVC-Exchange-Archiv
47 dConnectSyncProvisioning
213 dSVC-Monitoring-PRTG
340 dAPP-Intranet-SSO

Thresholds are per request, so one tenant can feed several sensors: the self-renewing Entra Connect certificate on a short threshold of its own, everything else on the normal one.

Two flavours

A handful of tenants, or a customer base

Both ship from the same repository and share the same Graph code. Pick by how many directories you look after and who needs to add one.

Classic service

Configured in a file, nothing to maintain

Stateless. Tenants come from environment variables or a small JSON file. Standard library only, so there is no dependency tree to keep patching.

No database, no accounts, no state
Web page, PRTG XML and JSON
Optional token, optional push to a PRTG sensor
Right for tenants you administer yourself

docker compose up -d

Portal

Customers added in the browser

Adds what a managed service provider needs: accounts with mandatory two-factor, encrypted credential storage and one scan per customer per day spread over 24 hours.

Onboarding without touching a config file
Credentials encrypted, bound to their record
Per customer PRTG token, served from the stored scan
Roles, audit trail, forced check on demand

docker compose -f docker-compose.portal.yml up -d

Portal dashboard listing five customer tenants with status, shortest remaining runtime, credential counts, time of last check and the daily scan slot. — The portal view: five customers, two of them needing attention. A sensor poll answers from the stored scan and never calls Microsoft Graph.

The small print

What it needs, and what it never sees

One permission

Application.Read.All, application-only, with admin consent. Metadata only.

Never the secret

Graph does not return secret values at all. Only names, dates and thumbprints leave the tenant.

Read-only by design

No write permission is requested, so it cannot change anything in your directory even by mistake.

Unprivileged container

Runs as UID 10001, read-only root filesystem, no new privileges.

Certificate or secret

Certificate authentication is preferred, since Entra caps secrets at 24 months.

Tested

328 tests covering aggregation, both renderers, the request path and the authentication flows.

Your app registrations expire.Usually on a Saturday.