> For the complete documentation index, see [llms.txt](https://hub.equipme.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hub.equipme.io/documentation/automation/connectors/microsoft-entra-id-connector/app-registrations-and-secrets.md).

# App Registrations and Secrets

App registrations are where integrations live, and their credentials are the part that expires. These components let you manage both, and watch the expiry dates before they become outages.

#### List Applications, Get Application, Create Application, Update Application, Delete Application

Full management of app registrations: display name, sign-in audience, notes, tags, identifier URIs and redirect URIs.

**Get Application** accepts either the object ID or the client ID, and additionally returns the metadata of all secrets and certificates on the registration.

#### Add Application Secret

Creates a new client secret. You give it a name and either a validity in months or an exact expiry date.

{% hint style="warning" %}
The secret value is returned in this one response and can never be retrieved again. This is Microsoft's behaviour, not a connector limitation.

Process it within the same flow run — write it to a password manager or key vault. If it is lost, the only route is to create a new secret.
{% endhint %}

#### Remove Application Secret

Removes a client secret by its key ID. Together with **Add Application Secret** this forms a rotation: create the new one, deploy it, then remove the old.

#### Add Application Certificate

Uploads a public certificate in PEM or Base64 DER format. Existing certificates on the registration are kept.

#### Add Application Owner

Adds an owner to an app registration.

#### List Expiring Secrets

Lists secrets across all app registrations with their remaining validity in days, most urgent first. Certificates, service principals and already expired credentials can be included, and a maximum remaining days value narrows the result.

{% hint style="info" %}
Include service principals if you run SAML or SSO applications. SAML signing certificates sit on the enterprise application, not on the app registration — without this option, the certificates that break single sign-on are exactly the ones you will not see.
{% endhint %}

#### Trigger: Secret Expiring

The monitoring trigger for expiring credentials. It runs on a configurable check interval and works with two thresholds, a warning threshold and a shorter escalation threshold. Certificates and service principals can be included in the check.

It has three separate outputs, so each stage can start its own branch:

| Output     | Fires when                                        |
| ---------- | ------------------------------------------------- |
| warning    | a credential falls below the warning threshold    |
| escalation | a credential falls below the escalation threshold |
| overdue    | a credential has expired                          |

The reason for three outputs is that each stage has a different audience. A warning is information for the owning team, an escalation needs someone to take responsibility, and an expired credential needs attention now.

{% hint style="warning" %}
Before wiring the escalation output to something that creates tickets, run the trigger in your own tenant for a few cycles and confirm how often it reports the same credential. Test first, then automate the part that is hard to undo.
{% endhint %}

A rotated secret receives a new key ID and is picked up by the check again from then on.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hub.equipme.io/documentation/automation/connectors/microsoft-entra-id-connector/app-registrations-and-secrets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.