Monitor App Registration Credential Expiry Using Managed Identity

# Replace with your Managed Identity Object ID (copied from Step 2)
$MI_OBJECT_ID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# Microsoft Graph app ID (same in every tenant)
$GRAPH_APP_ID = "00000003-0000-0000-c000-000000000000"

# Get the Graph service principal in your tenant
$graphSp = Get-AzADServicePrincipal -ApplicationId $GRAPH_APP_ID

# Find the Application.Read.All role definition ID
$roleId = ($graphSp.AppRole |
           Where-Object { $_.Value -eq "Application.Read.All" }).Id

# Assign the role to the Managed Identity
New-AzADServicePrincipalAppRoleAssignment `
    -ServicePrincipalId $MI_OBJECT_ID `
    -PrincipalId        $MI_OBJECT_ID `
    -ResourceId         $graphSp.Id `
    -AppRoleId          $roleId

Write-Host "Application.Read.All assigned successfully." -ForegroundColor Green

# Replace with your Managed Identity Object ID
MI_OBJECT_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

GRAPH_SP_ID=$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query id -o tsv)
ROLE_ID=$(az ad sp show --id 00000003-0000-0000-c000-000000000000 \
          --query "appRoles[?value=='Application.Read.All'].id" -o tsv)

az rest --method POST \
  --uri "https://graph.microsoft.com/v1.0/servicePrincipals/$MI_OBJECT_ID/appRoleAssignments" \
  --body "{\"principalId\":\"$MI_OBJECT_ID\",\"resourceId\":\"$GRAPH_SP_ID\",\"appRoleId\":\"$ROLE_ID\"}"

echo "Done."

# Replace with your Managed Identity Object ID
$MI_OBJECT_ID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

$assignments = Get-AzADServicePrincipalAppRoleAssignment -ServicePrincipalId $MI_OBJECT_ID

foreach ($a in $assignments) {
    $sp   = Get-AzADServicePrincipal -ObjectId $a.ResourceId
    $role = $sp.AppRole | Where-Object { $_.Id -eq $a.AppRoleId }
    [PSCustomObject]@{
        Resource   = $sp.DisplayName
        Permission = $role.Value
        AssignedOn = $a.CreatedAt
    }
} | Format-Table -AutoSize