App registration

Overview

App registration in Azure Active Directory (Azure AD) is the process of establishing a trust relationship between your application and the Microsoft identity platform. When you register an application, Azure AD can issue tokens to it based on its configured settings.

Azure AD represents applications in two ways:

• Application objects — define the application for Azure AD. They control how Azure AD issues tokens to the application based on its settings.
• Service principals — represent the instance of the application within your directory and control connections to Azure AD.

Business value

Monitoring app registrations through Turbo360 prevents certificate and client secret expiry from causing unexpected authentication failures. You receive alerts before credentials expire, giving your team time to renew them without service disruption.

Prerequisites

Before configuring expiry monitoring in Turbo360, grant the required API permission in Microsoft Azure:

1. Navigate to the corresponding app registration in your Azure Active Directory.
2. Select API permissions > Add a permission.
3. Select Microsoft Graph from the commonly used Microsoft APIs.
4. Choose Application permissions.
5. Select Application > Application.Read.All and add the permission.

Dependencies

The Application.Read.All permission must be granted on the app registration in Azure AD before Turbo360 can monitor its certificates and secrets.

How it works

Turbo360 tracks the expiration of client secrets and certificates for specific app registrations. When an expiry is approaching, Turbo360 sends a notification based on the threshold you configure, prompting you to renew the credential before it expires.

Permissions

Turbo360 uses role-based access control to restrict what users can do with App Registration resources. Permissions are assigned per resource type when configuring roles under User management.

Monitoring

App Registration supports certificate and client secret expiry monitoring. Navigate to App Registration > Monitoring to configure the rule.

Certificate and secret expiry monitoring

Expiry monitoring tracks the remaining validity of certificates and client secrets associated with your app registration. Use this rule to protect authentication flows from silent failures — for example, configure an alert 30 days before expiry so your team has time to rotate credentials before downstream services, integrations, or service principals lose access due to an expired secret or certificate.

1. Specify the number of days before expiry at which you want to receive the alert.
2. Click Save.

Troubleshooting

1. Alert not received before expiry
   Cause: The alert threshold may be set to fewer days than the current time remaining before expiry, or notifications are not configured.
   Fix: Verify the threshold value under App Registration > Monitoring and confirm that notification channels are active in your Turbo360 alert settings.

2. Permission error when saving the monitoring rule
   Cause: The Application.Read.All API permission has not been granted on the app registration in Azure AD, or the user does not have the Manage permission for App Registration in Turbo360.
   Fix: Complete the prerequisites steps to add the Application.Read.All permission in Azure AD, and confirm that the user's Turbo360 role includes Manage for App Registration.

3. Monitoring rule not reflecting updated threshold
   Cause: The change was not saved successfully, or a monitoring cycle has not yet completed.
   Fix: Re-open App Registration > Monitoring, update the threshold, and click Save. The updated state is reflected after the next monitoring cycle.

Related articles

• App Service Certificate
• Monitoring a Business Application
• Managing alert incidents