Provide background job to discover Azure AD apps that are about to expire

[tomkerkhove]

Is your feature request related to a problem? Please describe.
Provide background job to discover Azure AD apps that are about to expire and emit Azure Event Grid events for them.

[tomkerkhove]

@pim-simons is willing to contribute this.

What event type & payload do you have in mind?

[pim-simons]

What event type & payload do you have in mind?

In my project I am using the types ClientSecretAboutToExpire and ClientSecretExpired and as payload I am using:

{
    "displayName": "application name",
    "endDateTime": "2020-03-16T10:45:06",
    "keyId": "8a196371-1ad7-4f2b-8609-05bc5b6f7c27"
}

But very much open to suggestions or improvements on this.

[pim-simons]

We probably also need to take a look at making the window for the ClientSecretAboutToExpire event settable, right now I have it set hardcoded to 14 days which might not be the right value for every user.

[tomkerkhove]

What information do we have access to?

Things I'm thinking:

• Application Id
• Tenant Id (in case you have multiple)
• Object Id
• Owner

We probably also need to take a look at making the window for the ClientSecretAboutToExpire event settable, right now I have it set hardcoded to 14 days which might not be the right value for every user.

Sounds like a plan, because potentially you'd want to have notifications at 1 month, 14 days, 7 days and 1 day.

[fgheysels]

I've already opened an issue in the original project, but wouldn't it be possible to use Azure Managed Identity to query Azure AD instead of using a separate app registration & client secret ?
pim-simons/azuread.application.clientsecret.expiration#1

[tomkerkhove]

Both options are viable imo

[tomkerkhove]

Both for querying Azure AD and pushing to Azure Event Grid:
https://docs.microsoft.com/en-us/azure/event-grid/authenticate-with-active-directory

[pim-simons]

Regarding publishing to Azure Event Grid using Managed Identity, I am using Arcus.EventGrid to publish the events and as far as I can see in the documentation (https://eventgrid.arcus-azure.net/features/publishing-events) using Managed Identity isn't an option there. I can only find support for the authenticationkey with .UsingAuthenticationKey(endpointKey).

Will take a look at using Managed Identity for calling the Graph API.

[stijnmoreels]

Regarding publishing to Azure Event Grid using Managed Identity, I am using Arcus.EventGrid to publish the events and as far as I can see in the documentation (https://eventgrid.arcus-azure.net/features/publishing-events) using Managed Identity isn't an option there. I can only find support for the authenticationkey with .UsingAuthenticationKey(endpointKey).

Will take a look at using Managed Identity for calling the Graph API.

Is this something we should support in the event grid repo, @tomkerkhove ? If so, I'll create an issue for that.

[tomkerkhove]

Yes please! But not blocking for the first version of this job imo