Get the list of expired or soon-to-expire azure app registrations

list-expiring-app-registrations.ps1

$daysToExpire = 30
$SoonToBeExpiredList = @()
$AlreadyExpiredList = @()


# Connect to AzureAD
Write-Output "Connecting to AzureAD..."
$connection = Get-AutomationConnection -Name AzureRunAsConnection
Connect-AzureAD -TenantId $connection.TenantID -ApplicationId $connection.ApplicationID -CertificateThumbprint $connection.CertificateThumbprint
Write-Output "Connected to AzureAD..."


# get the list of all app registrations, including enterprise applications
$apps = Get-AzureADApplication -All $true

foreach($app in $apps) { 
    # check for expiry date
    $today = Get-Date
    $NotToExpireSoon = $app.PasswordCredentials | Where-Object {(NEW-TIMESPAN -Start $today -End $_.EndDate).Days -gt $daysToExpire }
    $SoonToBeExpired = $app.PasswordCredentials | Where-Object {((NEW-TIMESPAN -Start $today -End $_.EndDate).Days -lt $daysToExpire) -and ((NEW-TIMESPAN -Start $today -End $_.EndDate).Days -gt 0) }
    $AlreadyExpired = $app.PasswordCredentials | Where-Object {(NEW-TIMESPAN -Start $today -End $_.EndDate).Days -le 0 }

    # compare expiry date
    if(($NotToExpireSoon -ne $null) -and ($NotToExpireSoon.Count -gt 0)) 
    {
        Write-Host -ForegroundColor Green "$($app.DisplayName) is still valid"
    }
    elseif(($NotToExpireSoon.Count -eq 0) -and ($SoonToBeExpired.Count -gt 0)) 
    {
        # all credentials are either expired or about to expire, hence the underlying service principal is not yet expired but it is soon to be. It thus requires extra attention.
        $SoonToBeExpiredList += $app
    }
    elseif($AlreadyExpired.Count -eq $app.PasswordCredentials.Count) 
    {
        # all credentials are actually expired hence the underlying service principal is expired
        $AlreadyExpiredList += $app
    }
}


# display the list of expired credentials
Write-Host -ForegroundColor Red "Expired credentials"
foreach($expiredApp in $AlreadyExpiredList) {
    Write-Host "AppId: $($expiredApp.AppId) - DisplayName: $($expiredApp.DisplayName)" 
}

# display the list of soon-to-be-expired credentials
Write-Host -ForegroundColor Yellow "Soon-to-be-expired credentials"
foreach($almostExpiredApp in $SoonToBeExpiredList) {
    Write-Host "AppId: $($almostExpiredApp.AppId) - DisplayName: $($almostExpiredApp.DisplayName)"
}


write-host -ForegroundColor Cyan "Listing completed"

would be great to also check apps with saml sso cert expiring in same script