What’s the best way to manage and rotate Microsoft Entra client secrets?

The usual approach is to automate the process. An Azure Automation runbook or an on-premises DevOps agent can use a dedicated Entra application with tightly scoped permissions to create a replacement secret, store it in Azure Key Vault, and notify the application owner. You can also run regular Microsoft Graph queries to find application credentials that are approaching expiration.

Managed identities and federated credentials do not mean you stop having an app registration. They provide a different credential method for that identity: Azure resources can authenticate with a managed identity, and external OIDC providers can exchange their short-lived tokens for Entra tokens through a federated credential. User-facing applications may still need an app registration, but their workload components do not automatically need a client secret.

When a secret is unavoidable, rotate it using an overlap period instead of replacing it in one step. Create the new credential, deploy it to the application, verify that authentication works, and only then remove the old credential. Keep the value in Key Vault rather than application configuration, and consider certificates when supported because they can also be staged in advance.

Avoid solving the problem by creating extremely long-lived secrets. A long expiration period only delays the maintenance and increases the chance that nobody remembers who owns or uses the credential.

First, avoid client secrets wherever possible. Workloads running on Azure should generally use managed identities, while GitHub Actions, AKS, and other OIDC-capable platforms can use workload identity federation. These options use short-lived tokens and remove the need to store and rotate a long-lived secret.

For systems that genuinely require a secret, track expiration dates and alert owners well in advance. A scheduled script or Automation runbook can query applications and service principals through Microsoft Graph, identify credentials expiring within a chosen window, and send notifications. Assigning an owner to every application is just as important as the monitoring.