Expired client secret Azure

Question

Is it possible to determine which resource (API, app service, application) is using an expired client secret? The app registration to which the expired client secret belongs has multiple valid client secrets, but I don't know which resource is using the expired client secret.

I tried to manually look into logic apps. into the keyvault etc.

Answer 1

As I mentioned in comments, to determine which resource is using an expired client secret, you can check the Azure AD sign-in logs to see which applications are failing to authenticate. You can also check the Azure AD audit logs to see which applications are using the expired client secret.

1. Go to the Azure portal and navigate to Azure Active Directory.
2. Click on "Sign-ins" under the "Monitoring" section.
3. Filter the logs by failure.
4. Look for sign-in failures related to the expired client secret.

same way for audit log-

Additionally, you can use azure log analytics to query your requirement

To search for the expired client secret issue, you will want to look for failed sign-ins related to the service principal (application). Here's a query that should help you identify failed sign-ins potentially due to an expired client secret:

SigninLogs
| where ResultType != 0 // here 0 is a successful sign-in
| where AppId == "<App Registration Application (client) ID>" // replace with your actual application ID
| project TimeGenerated, AppDisplayName, AppId, ResultDescription, ResultType, CorrelationId, IPAddress, Location
| sort by TimeGenerated desc

This query will list the failed sign-in attempts for the application specified by the <App Registration Application (client) ID>. Be sure to replace <App Registration Application (client) ID> with your actual Application ID.

or you don't even have to go that critical and simply use

SigninLogs
| where Status contains "Failure"

and then export it as excel and filter out with failure reason.

The ResultType field is used here to filter out successful sign-ins; typically, 0 indicates success, so any non-zero ResultType could indicate a failure, which might be due to the expired client secret. ResultDescription should give you more information about why the sign-in attempt failed.