Azure Active Directory Application Key Renewal

Question

When configuring an application in Azure Active Directory you can create keys which are valid for either 1 or 2 years. In an organization with many services and clients, how do you manage key renewal?

Does Azure Active Directory tell you when a key is approaching expiry? Is there a way to generate a key with a longer lifetime or even an indefinite lifetime?

Answer 1

Update September 2016: it is now possible to chose an infinite expiration date from the New Portal. Behind the scenes, it’s actually not infinite but it sets a date very far in the future.

source: https://stephaneeyskens.wordpress.com/2016/01/14/managing-expiration-of-azure-active-directory-application-client-secrets/

Answer 2

Unfortunately, the only way to find out when the Azure Active Directory (AAD) application key/client secret's expiry period is through the Azure old portal as of today.

Besides, as you can see in the Azure old portal, there are only 2 options available for the key duration, i.e. 1 year or 2 years.

Hope this helps!

Answer 3

For the application that I am writing I have managed to set the expire time 99 years by manually creating an application. You can also update existing applications with new Keys using the AppId.

To do this I used a Native application;

var app = (Application)await GraphAPI.NativeConnection.Applications.Where(a => a.AppId.Equals(appClientId)).ExecuteSingleAsync();
string clientSecert = Guid.NewGuid().ToString();
DateTime exipre = DateTime.UtcNow.AddYears(99);
PasswordCredential pwc = new PasswordCredential
{
    StartDate = DateTime.UtcNow,
    EndDate = exipre,
    KeyId = Guid.NewGuid(),
    Value = clientSecert
};

app.PasswordCredentials.Add(pwc);
await app.UpdateAsync();

return new AppData { ClientId = appClientId, ClientSecert = clientSecert, ExpireDate = exipre };

GraphAPI.NativeConnection is a singleton instance of a native application via the graph API for azure.

Edit, this singleton is my own implementation

Since you normally see the new secret in the web page of the management portal you will need to store the secret and show it to the user to write down.

When creating a new application you will need to ResourceAccess as well. These items can be found in the manifest of other applications.