Manage Monitoring of App Registrations in Azure
Take control of your Azure App Registrations with Nodinite. This guide shows you how to manage monitoring, perform Remote Actions, and empower your Users with secure, role-based access, without granting direct Azure Portal access.
- ✅ Receive proactive alerts before a Secret or Certificate expires
- ✅ Instantly access Owner and Scope information
- ✅ Monitor Federated credentials and customize thresholds
- ✅ Delegate secure, self-service management to business and support teams
Animated walkthrough: open Edit from the Action menu, review the Secrets and Certificates limits, and read the note that the change applies to every App Registration in the Subscription.
Use Nodinite to manage, monitor, and secure your Azure App Registrations for business agility and operational excellence.
Nodinite uses an App Registration to connect and authenticate with the Azure REST API. Learn more in the Azure Application Access guide and the Azure user rights section of the Prerequisites.
Delegate management and insights for selected App Registrations in Azure to your business and end-users. Nodinite Monitoring empowers support and maintenance teams with actionable data for root cause analysis, without direct Azure Portal access. This approach reduces attack vectors and minimizes risk for mission-critical services.
Need the monitoring background first? Read Monitoring App Registration to see how Nodinite discovers and evaluates app registrations, secrets, permissions, and certificates before you manage them.
Diagram: The Nodinite Azure Agent (blue) monitors App Registrations (teal) and their secrets, federated credentials, scopes, owners, certificates, and app roles in Azure.
| Application Management Team | IT Operations | Business |
|---|---|---|
| Empower your AM team to be proactive without disturbing IT operations | Maintain full control with complete access | Enable business users with information and self-service for Azure solutions |
Note
To optimize performance and conserve system resources, Nodinite caches App Registration data for five minutes. If you make changes in Azure, wait for the cache to update or restart the agent to see the latest information.
Management Features
For Resources in Role-based Monitor Views with Remote Actions privileges, Nodinite provides these remote actions grouped by Category:
| Category | Monitoring | Actions | Metrics/Statistics |
|---|---|---|---|
| Azure App Registration configuration | ✅ Yes | Details Edit |
- |
As an Administrator with access to Configuration for Monitoring Agents, you can:
| Monitoring | Remote Configuration |
|---|---|
| Monitoring App Registration | Manage monitoring thresholds |
Azure App Registration
Manage the set of monitored App Registrations from the App Registration Details page.
The 'Azure App Registration' Category provides one Resource for each configured App Registration, using the specified display name as the Resource name.
Example: Monitor View filtered on the App Registration Category; expired credentials show as Error.
See Monitoring App Registration for more details about monitoring.
The App Registration category provides Resources that display the evaluated monitored state according to built-in rules.
If you have permission to perform Remote Actions, you can:
Example: the Action menu of an App Registration; the Remote Actions are under Control Center.
Details
The Details modal shows the App Registration's facts at the top, followed by these sections, in this order:
- Essential information (the top of the modal)
- Client secrets
- Federated credentials
- API Permissions
- Scopes
- Owners
- App roles
- CertificatesNew 6.2.1.2
To view a selected App Registration Resource, click the Action button and select Details from the Control Center part of the menu.
Open the Details modal for the selected App Registration.
Essential information
The top of the Details modal holds the App Registration's facts: TenantId, Subscription, Subscription ID, Home page URL, Terms of service URL, Privacy Statement URL, Service Management Reference, Internal notes, Verified Publisher Id (MPN ID), and Verified publisher name. Refresh reloads the data from Azure.
Settings apply at the Subscription level. If you have multiple subscriptions for a single Tenant ID, only one configuration entry can have App Registration Monitoring enabled (Configuration).
Example: the Details modal; the sections continue below the API Permissions.
Client secrets
Nodinite monitors Client Secrets according to the Secret thresholds of the Subscription. Each row shows Status (OK or Expired), Description, Secret ID, a masked Value, Created, and Expires.
Example: Client secrets; an expired secret puts the App Registration in Error.
Federated credentials
Lists the Name, Description, Subject identifier, and Issuer of each federated credential. An App Registration that has only federated credentials is OK.
Example: Federated credentials.
API Permissions
New 6.2.1.3
The App Registration in use must have the Microsoft Graph application permission to read grants in order to present API Permissions. Grant admin consent for that permission, and see the Azure Application Access guide and its least privileges page for the full setup.
The permissions are grouped per API, with Type, Description, Admin consent, and a Status of Granted or Not granted.
Example: assigned API Permissions and their grant status.
If you see the following message, add the Microsoft Graph application permission DelegatedPermissionGrant.Read.All to the Application in use for the monitored Subscription and grant admin consent.
This warning means the monitoring agent cannot read the grant status for the selected App Registration. It does not indicate a missing Azure RBAC assignment on the monitored resource.
Unable to display information about the status of grants because the current App Registration ('{client id}') does not have permission to read this information. Please ensure that you add the DelegatedPermissionGrant.Read.All permission to the application. Additionally, note that the access token is cached, which means you either need to wait or restart the Monitoring agent after applying the changes in the Azure portal.
Example of the error message shown when the App Registration in use is missing the required Microsoft Graph permission or admin consent.
Scopes
Lists the exposed API scopes under the App Registration's AppId: Scope, Who can consent, Admin consent display, and User consent display.
Example: Scopes.
Owners
The App Registration in use must have permission to read user profiles to present information about Owners. For more information, see the Azure Application Access guide.
Example: Owners, with Name, Email, User name, Job title, and Type.
App roles
Lists the App Registration's app roles with State, Display name, Description, Allowed member types, Value, and Id.
Certificates
New 6.2.1.2
Nodinite monitors Certificates according to the Certificate thresholds of the Subscription. For certificates stored outside App Registrations, see Monitoring Azure Certificates and Monitoring Azure Key Vault.
Example: Certificates, with Status, Thumbprint, Description, Start date, Expires, and Certificate ID.
Edit thresholds
Info
The thresholds are global for the Subscription: a change affects the Monitoring of every App Registration in that Subscription, whichever one you edit. The dialog says so in its NOTE.
You can manage monitoring thresholds for:
- Secrets
- CertificatesNew 6.2.1.2
To edit monitoring thresholds, click the Action button and select Edit from the Control Center part of the menu.
The Edit menu item.
The Edit dialog: Secrets and Certificates limits in whole days, a Description, and the note about the global settings.
- Description – User-friendly description of the App Registration monitoring configuration
Click Save to persist changes.
Save button.
Secret thresholds
You can manage these monitoring properties for Secrets, in whole days:
- ⚠️ Warning – a Secret that expires within this many days puts the App Registration in Warning (default 14)
- ❌ Error – a Secret that expires within this many days puts the App Registration in Error (default 7)
Set the Error limit lower than the Warning limit. An expired Secret is always Error.
Certificate thresholds
New 6.2.1.2
You can manage these monitoring properties for Certificates, in whole days:
- ⚠️ Warning – a Certificate that expires within this many days puts the App Registration in Warning (default 14)
- ❌ Error – a Certificate that expires within this many days puts the App Registration in Error (default 7)
Set the Error limit lower than the Warning limit. An expired Certificate is always Error.
Alarm Plugins send the alerts when a threshold is reached; use Expected State to override the evaluated state for a single Resource.