Audit App Registrations and Service Principal Secrets with PowerShell
Find expiring secrets, dangerous API permissions, and unused service principals before they become an incident.
App registrations and service principals are the easiest place for an Entra ID tenant to go wrong. Secrets get added with two-year expirations and never rotated, dangerous Graph permissions get consented to once and never reviewed, and old apps from departed projects keep their tokens long after anyone remembers what they were for.
The Microsoft.Graph PowerShell SDK exposes everything you need to audit and clean this up. PSForge gives you the tasks ready to assemble into a workflow your security team can run on a schedule.
What this audit needs to surface
- App registrations and service principals with their owners (or lack of)
- Client secrets and certificates that expire in the next 30, 60, and 90 days
- Apps with high-risk Microsoft Graph application permissions
- Service principals that have not had a sign-in in 90+ days
- Apps registered by users who have since left the company
Why this is one workflow, not seven scripts
Most teams have a few of these scripts already, scattered across runbooks and OneDrives. The problem is that no one runs all of them on the same day, against the same tenant, with one report at the end.
PSForge lets you assemble the app registration tasks into a single workflow, generate the PowerShell, and schedule it so the security team gets one consolidated report each week.
Example app registration audit workflow
- Connect to Microsoft Graph with the right scopes
- List every app registration and service principal with its owners
- Identify secrets and certificates expiring in 30, 60, and 90 days
- Report on apps holding high-risk Graph application permissions
- Surface service principals with no recent sign-in activity
- Cross-reference owners against current Entra ID users to find orphans
- Export the consolidated audit to CSV for the security team
Final thoughts
App registrations are one of the most common ways modern tenants get compromised.
PSForge makes it easy to build a single PowerShell workflow that keeps secrets fresh, permissions reviewed, and stale apps cleaned up before they become an incident.