Email Reports on Expiring Microsoft Entra ID App Secrets and Certificates with Microsoft Graph

This n8n workflow automates the process of generating and emailing reports on expiring application secrets and certificates within Microsoft Entra ID (formerly Azure Active Directory). It leverages the Microsoft Graph API to retrieve the necessary data, filters for items nearing expiration, formats the information into a readable HTML table, and sends it via email.

What it does

1. Manually Trigger: The workflow is initiated manually, allowing for on-demand execution.
2. Fetch Application Data: It makes an HTTP request to the Microsoft Graph API to retrieve a list of all applications registered in Microsoft Entra ID.
3. Process Application Data:
   • It iterates through each application.
   • For each application, it checks its configured password credentials (secrets) and key credentials (certificates).
   • It filters these credentials, keeping only those that are set to expire within a defined timeframe (e.g., 90 days from the current date).
   • It extracts relevant details such as application name, credential type, key ID, and expiration date.
4. Format Report Data:
   • It aggregates the filtered expiring credentials into a single dataset.
   • It then transforms this data into an HTML table format, making it suitable for email presentation.
5. Conditional Email Sending:
   • It checks if there are any expiring secrets or certificates found.
   • If expiring items are found, an email containing the HTML report is sent.
   • If no expiring items are found, the workflow concludes without sending an email.
6. Send Email: An email is sent with the formatted HTML table listing all expiring application secrets and certificates.

Prerequisites/Requirements

• n8n Instance: A running n8n instance.
• Microsoft Entra ID (Azure AD) Application Registration: An application registered in Microsoft Entra ID with appropriate permissions to read application details (e.g., Application.Read.All or Directory.Read.All Microsoft Graph API permissions).
• Microsoft Graph API Credentials: An OAuth2 or client credentials setup in n8n for authenticating with the Microsoft Graph API.
• SMTP Server Configuration: An SMTP server configured in n8n to send emails.
• Email Recipient(s): The email address(es) to which the report should be sent.

Setup/Usage

1. Import the Workflow: Import the provided JSON into your n8n instance.
2. Configure Microsoft Graph Credentials:
   • Locate the "HTTP Request" node (ID: 19).
   • Configure the "Authentication" section to use your Microsoft Graph API credentials. This typically involves setting up an OAuth2 or Client Credentials credential in n8n that points to your Microsoft Entra ID application registration.
   • Ensure the configured application has the necessary permissions to read application data (Application.Read.All or Directory.Read.All).
3. Configure Email Sending:
   • Locate the "Send Email" node (ID: 11).
   • Set up your SMTP credentials in n8n.
   • Specify the "To" email address(es) where you want the reports to be sent.
   • Adjust the "Subject" and "Body" as needed. The body will typically reference the HTML table generated earlier.
4. Adjust Expiration Threshold (Optional):
   • The "Filter" node (ID: 844) is likely configured to filter items expiring within a certain timeframe. You can adjust this logic to suit your organization's reporting needs (e.g., 30, 60, or 180 days).
5. Activate and Execute:
   • Activate the workflow.
   • Click "Execute Workflow" on the "Manual Trigger" node to run it on demand, or set up a "Schedule Trigger" if you want it to run periodically (e.g., daily, weekly).