7.4 KiB
Azure App Registrations and Entra ID Account Expiry Notification
This repository contains an Azure Function that monitors Azure App Registrations and Entra ID account credentials, particularly focusing on the expiry of password credentials for both. It automatically fetches app registrations and account details, processes expiry information, and sends notifications to relevant stakeholders.
Features
- Fetches Azure App Registrations and associated credentials (password credentials).
- Retrieves specific Entra ID accounts and checks their password expiration.
- Sorts and classifies the credentials based on their expiry dates.
- Sends a customized email notification to users, with an HTML table showing the details of expiring or expired credentials.
Requirements
Environment Variables:
The following environment variables are required for the function to authenticate to Microsoft Graph API and send emails.
They will be set by the pipeline, an AzureDevOps Variable Group called "FunctionVariables" must be created manually.
- AZURE_CLIENT_ID: The Azure AD application client ID.
- AZURE_CLIENT_SECRET: The Azure AD application client secret.
- AZURE_TENANT_ID: The Azure AD tenant ID.
- MONITORED_ACCOUNTS: A comma-separated list of user principal names (UPNs) to monitor for password expiry.
- SMTP_SERVER: The SMTP server for sending email notifications.
- SMTP_PORT: The port to use for SMTP (usually 587).
- SMTP_USERNAME: The SMTP server username.
- SMTP_PASSWORD: The SMTP server password.
- FROM_EMAIL: The email address from which the notifications will be sent.
- FROM_NAME: The name displayed for the FROM_EMAIL address.
- TO_EMAIL: The recipient email address for the notifications.
Function Workflow
- Authentication: The function authenticates to Microsoft Graph API using the Azure AD application credentials (Client ID, Client Secret, Tenant ID).
- Fetching Data:
- The function fetches all app registrations and their associated password credentials using Microsoft Graph API.
- It fetches user account details for the specified Entra ID accounts and checks for password expiration.
- Processing Expiry Dates: The credentials are processed to calculate the days until expiration. The credentials are sorted and categorized as:
- Green: More than 30 days to expiration.
- Yellow: Between 8-30 days to expiration.
- Orange: 7 days or less to expiration.
- Red: Expired.
- Blue: No expiration set.
- Email Notification:
- The function generates an HTML report that contains all relevant app registrations and account details.
- The report is sent via email to the specified recipient and optionally to the owners of the apps.
Email Notification Example
The email notification contains an HTML table that shows:
- App Registrations: Display name, secret name, expiry date, days to expiry, and owners.
- Entra ID Accounts: Display name, user principal name, password expiry date, and status.
Color Coding in the Notification:
- Green: More than 30 days until expiry.
- Yellow: Between 8-30 days until expiry.
- Orange: 7 days or less until expiry.
- Red: Expired.
- Blue: No expiration set.
Notes
- Ensure that the monitored accounts list is correctly populated with the UPNs of the users whose password expiry you want to track.
- The email notification will only be sent if there are app registrations or Entra ID accounts with upcoming or expired credentials.
Local Setup
1. Clone the repository:
git clone https://github.com/OliPassey/AzAppRegistrationExpiry.git
2. Install dependencies:
Ensure that you have the necessary libraries installed in your environment:
pip install -r requirements.txt
3. Configure Environment Variables:
You need to set the following environment variables:
- Azure Authentication: These variables are used to authenticate against Microsoft Graph API.
- SMTP Configuration: These variables are used to send email notifications. Example for local development (Linux/macOS):
export AZURE_CLIENT_ID="<your-client-id>"
export AZURE_CLIENT_SECRET="<your-client-secret>"
export AZURE_TENANT_ID="<your-tenant-id>"
export MONITORED_ACCOUNTS="user1@domain.com, user2@domain.com"
export SMTP_SERVER="smtp.yourserver.com"
export SMTP_PORT="587"
export SMTP_USERNAME="your-smtp-username"
export SMTP_PASSWORD="your-smtp-password"
export FROM_EMAIL="your-email@domain.com"
export FROM_NAME="Your Name"
export TO_EMAIL="recipient-email@domain.com"
or create a local.settings.json file:
{
"IsEncrypted": false,
"Values": {
"AzureWebJobsStorage": "<connection-string>",
"FUNCTIONS_WORKER_RUNTIME": "python",
"AZURE_CLIENT_ID": "",
"AZURE_CLIENT_SECRET": "",
"AZURE_TENANT_ID": "",
"SMTP_SERVER": "",
"SMTP_PORT": "",
"SMTP_USERNAME": "",
"SMTP_PASSWORD": "",
"FROM_EMAIL": "",
"FROM_NAME": "",
"TO_EMAIL": "",
"MONITORED_ACCOUNTS": ""
}
}
4a. Run Locally:
Install Required tools:
- Python 3.11
- Download from python.org
- Ensure it's added to your PATH
- Azure Functions Core Tools v4
- Install via npm:
npm install -g azure-functions-core-tools@4 - Or download from GitHub releases
- Install via npm:
- Azure CLI
- Download from Microsoft's website
- Needed for authenticating with Azure services
Setup local environment
-
Create a Python Virtual Environment
## Navigate to your project directory
bash cd C:/code/AzAppRegistrationExpiry## Create a virtual environment
bash python -m venv .venv## Activate the environment
## On Windows:
bash .venv\Scripts\activate## On macOS/Linux:
bash source .venv/bin/activate -
Install Dependencies
bash pip install -r requirements.txt -
Setup local.settings.json
- You already have this file with your settings configured
- Make sure it's in your project root directory
Running the Function Locally
- Start the Function App
func start
-
Trigger the Function Manually (since it's a timer trigger)
bash func function invoke aio --no-interactive
4. Deploy to Azure:
Follow Azure Functions deployment guide to deploy the function to Azure. Also see additional Wiki document "Pipelines & Deployment"
func azure functionapp publish AzureAppRegExpMon --python