Report Expiring Application Credentials Scheduled
List expiry date of all Application Registration credentials
Description
This runbook lists the expiry dates of application registration credentials, including client secrets and certificates. It can optionally filter by application IDs and can limit output to credentials that are about to expire.
Optionally, the report can be sent via email with CSV and/or Excel (xlsx) attachments. The report files can also be uploaded to an Azure Storage Account, returning time-limited download links. The ReportFileFormat parameter controls which file formats are generated and delivered (CSV only, CSV & XLSX, or XLSX only). When the CSV attachment exceeds the email size limit and "CSV & XLSX" is selected, the email falls back to the Excel workbook alone.
Setup regarding email sending
Sending an email report is optional and only happens when a recipient (EmailTo) is provided. The sender address is taken from the RJReport.EmailSender tenant setting.
This runbook sends emails using the Microsoft Graph API. To send emails via Graph API, you need to configure an existing email address in the runbook customization.
See the RealmJoin Report Settings documentation for details on all available settings.
Email branding
The report email honors the optional RJReport.Branding.* tenant settings:
Header and footer image – public HTTPS URLs, PNG/JPEG/GIF, max. 200 KB each
Footer link – target of the footer image
Accent and text color – 6-digit hex values, e.g.
#0052cc
When these settings are not configured, the default RealmJoin graphics and colors are used. An image that cannot be downloaded or validated, or an invalid color value, never prevents the report email – the corresponding default is used instead.
Setup instructions and image requirements: Email branding.
Location
Organization → Applications → Report Expiring Application Credentials (Scheduled)
Full Runbook name
rjgit-org_applications_report-expiring-application-credentials_scheduled
Details
Version
1.3.0
Required modules
RealmJoin.RunbookHelper (>= 0.8.9) Microsoft.Graph.Authentication (>= 2.39.0) Az.Accounts (>= 5.5.2)
Schedulable
yes
Permissions
Application permissions
Type: Microsoft Graph
Application.Read.All
Reads all app registrations to evaluate certificate and secret expiry dates
Mail.Send (optional — feature: Email report)
Sends the report email via Send-RjReportEmail when EmailTo is configured
Organization.Read.All
Reads /organization for the tenant name and id in the report
Parameters
listOnlyExpiring
If only credentials that are about to expire within the specified number of days should be listed, select "List only credentials about to expire" (final value: true). If you want to list all credentials regardless of their expiry date, select "List all credentials" (final value: false).
Required
false
Default Value
True
Type
Boolean
Portal options
List only credentials about to expire
true
List all credentials
false
Days
The number of days before a credential expires to consider it "about to expire".
Required
false
Default Value
30
Type
Int32
Portal display name
Days before credential expiry
CredentialType
Filter by credential type: "Both" (default), "ClientSecrets", or "Certificates".
Required
false
Default Value
Both
Type
String
Portal display name
Credential Type Filter
Portal options
Client Secrets and Certificates
Both
Only Client Secrets
ClientSecrets
Only Certificates
Certificates
ApplicationIds
Optional - comma-separated list of Application IDs to filter the credentials.
Required
false
Default Value
Type
String
Portal display name
Application IDs
ReportFileFormat
Controls which report file formats are generated and delivered: "CSV only", "CSV & XLSX" (default) or "XLSX only".
Required
false
Default Value
CSV & XLSX
Type
String
Portal display name
Report file format
Portal options
CSV & XLSX
CSV only
XLSX only
CreateDownloadLink
If enabled, the report files are uploaded to an Azure Storage Account and time-limited download links are returned. Disabled by default.
Required
false
Default Value
False
Type
Boolean
Portal display name
Create a file download link (upload report to storage)?
Portal options
Yes - upload report and return a download link
true
No - do not create a download link
false
ContainerName
Storage container name used for the upload. Configured per runbook (not a global RJReport setting).
Required
false
Default Value
report-expiring-app-credentials
Type
String
Hidden in portal
yes (preset via runbook customization)
ResourceGroupName
Resource group that contains the storage account. Sourced from the RJReport tenant settings.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
StorageAccountName
Storage account name used for the upload. Sourced from the RJReport tenant settings.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
LinkExpiryDays
Number of days until the generated download link expires. Sourced from the RJReport tenant settings.
Required
false
Default Value
6
Type
Int32
Hidden in portal
yes (preset via runbook customization)
EmailTo
If specified, an email with the report will be sent to the provided address(es). Can be a single address or multiple comma-separated addresses (string). The function sends individual emails to each recipient for privacy reasons.
Required
false
Default Value
Type
String
Portal display name
Recipient Email Address(es)
EmailFrom
The sender email address. This needs to be configured in the runbook customization.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
BrandingHeaderImageUrl
Optional public HTTPS URL of a custom header image (PNG/JPEG/GIF, max. 200 KB) for the report email. Sourced from the RJReport.Branding.HeaderImageUrl tenant setting. When empty, the default RealmJoin header graphic is used.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
BrandingFooterImageUrl
Optional public HTTPS URL of a custom footer image (PNG/JPEG/GIF, max. 200 KB) for the report email. Sourced from the RJReport.Branding.FooterImageUrl tenant setting. When empty, the default RealmJoin footer graphic is used.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
BrandingFooterLink
Optional URL the footer image links to. Sourced from the RJReport.Branding.FooterLink tenant setting. When empty, the default link (https://www.realmjoin.com) is used.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
BrandingAccentColor
Optional accent color override (6-digit hex, e.g. '#0052cc') for the report email template. Sourced from the RJReport.Branding.AccentColor tenant setting. When empty or invalid, the default RealmJoin accent color is used.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
BrandingTextColor
Optional text color override (6-digit hex) for the report email template. Sourced from the RJReport.Branding.TextColor tenant setting. When empty or invalid, the default RealmJoin text color is used.
Required
false
Default Value
Type
String
Hidden in portal
yes (preset via runbook customization)
Last updated
Was this helpful?