https://github.com/simon-vedder/app-lifecycle-analyzer

Read-only lifecycle audit for Entra ID app registrations — secrets, certs, federated creds, sign-in activity, in one HTML report
https://github.com/simon-vedder/app-lifecycle-analyzer

app-registration azure entra-id identity powershell security

Last synced: 2 days ago
JSON representation

Read-only lifecycle audit for Entra ID app registrations — secrets, certs, federated creds, sign-in activity, in one HTML report

• Host: GitHub
• URL: https://github.com/simon-vedder/app-lifecycle-analyzer
• Owner: simon-vedder
• License: mit
• Created: 2026-07-16T15:36:01.000Z (10 days ago)
• Default Branch: main
• Last Pushed: 2026-07-16T16:38:43.000Z (10 days ago)
• Last Synced: 2026-07-16T18:17:57.246Z (10 days ago)
• Topics: app-registration, azure, entra-id, identity, powershell, security
• Language: PowerShell
• Size: 15.6 KB
• Stars: 0
• Watchers: 0
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# App Lifecycle Analyzer

![PowerShell](https://img.shields.io/badge/PowerShell-7%2B-5391FE?logo=powershell&logoColor=white)

![Microsoft Entra ID](https://img.shields.io/badge/Microsoft-Entra_ID-0078D4?logo=microsoftazure&logoColor=white)

![Access: read-only](https://img.shields.io/badge/access-read--only-16a34a)

![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)

![Last commit](https://img.shields.io/github/last-commit/simon-vedder/app-lifecycle-analyzer)

**Read-only lifecycle audit for Microsoft Entra ID app registrations — in one HTML report.**

Scans every app registration in your tenant and produces a single self-contained, interactive HTML

report: per app its secrets, certificates and federated credentials, their expiry, last sign-in

activity, and copy-only remediation commands for cleaning up what's expired or unused. Nothing is

changed in your tenant — the report *shows* you the fix command and lets you copy it; you run it in a

write-scoped session yourself.

![The App Lifecycle Analyzer report — per-app credential expiry, activity status and cleanup commands](docs/screenshot.png)

> ▶ **See a sample:** open [`docs/sample-report.html`](docs/sample-report.html)

> in a browser — a fully populated demo report built from synthetic app

> registrations (no tenant was accessed).

## What it surfaces

- **Credential expiry** — secrets and certificates that are expired or expiring soon, per app.

- **Federated credentials** — apps using workload identity federation instead of secrets.

- **Sign-in activity** — when the app / service principal was last used (needs Entra ID P1/P2).

- **Cleanup commands** — copy-only `Remove-MgApplicationPassword` / cert removal, keyId-targeted, plus

  bulk "remove all expired" — never executed by the tool.

## Usage

```powershell

./AppLifecycleAnalyzer.ps1

```

The report opens in your browser: search, filter (has secret / cert / federated / none), and sort by

credential exposure. Click an app for detail and copy the exact remediation command.

## Permissions

Read-only Microsoft Graph delegated scopes:

`Application.Read.All`, `Directory.Read.All`, `AuditLog.Read.All` (sign-in activity needs Entra ID P1/P2).

## Related

- **[Least Privilege Studio](https://github.com/simon-vedder/least-privilege-studio)** — Azure RBAC least-privilege tooling.

- Write-up: [App Lifecycle Analysis for Entra ID](https://simonvedder.com/app-lifecycle-analysis-for-entra-id/)

---

by [Simon Vedder](https://simonvedder.com)