How to find expiring SAML certificates in Entra ID

Before you start

Use an account in a role that can list applications, such as Global Reader, Cloud Application Administrator or Application Administrator. The PowerShell example requests Application.Read.All; your organisation may require administrator consent. Making a new certificate or activating one needs at least Cloud Application Administrator, and isn't part of this check.

Know what you are reading. A SAML signing certificate is kept on the app's service principal as a private key used to sign and a public key used to verify, so the examples read the signing half to list each certificate once. Older SAML apps can have no single sign-on mode set, so a filter on it misses them. The examples read and export; they don't create, activate or remove any certificate.

Option 1

Find expiring SAML certificates with PowerShell

Install the modules once, then connect and export the signing certificates of SAML apps that end within 90 days or have already ended. The single sign-on filter runs in Microsoft Graph, so only SAML apps come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Applications -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$days = 90
$now = (Get-Date).ToUniversalTime()
Connect-MgGraph -Scopes 'Application.Read.All' -NoWelcome
try {
    $properties = 'id', 'appId', 'displayName', 'accountEnabled', 'keyCredentials',
        'notificationEmailAddresses'
    $filter = "preferredSingleSignOnMode eq 'saml'"
    $apps = @(Get-MgServicePrincipal -All -Filter $filter -Property $properties)
    $report = @(foreach ($app in $apps) {
        foreach ($key in $app.KeyCredentials | Where-Object { $_.Usage -eq 'Sign' }) {
            if (-not $key.EndDateTime) { continue }
            $end = $key.EndDateTime.ToUniversalTime()
            $left = [math]::Floor(($end - $now).TotalDays)
            if ($left -gt $days) { continue }
            [pscustomobject]@{
                Application = $app.DisplayName
                Certificate = $key.DisplayName
                EndsUtc     = $end
                DaysLeft    = $left
                AppEnabled  = $app.AccountEnabled
                NotifyTo    = @($app.NotificationEmailAddresses) -join '; '
                AppId       = $app.AppId
            }
        }
    })
    if ($report.Count -eq 0) {
        Write-Output "No SAML signing certificate ends within $days days."
    } else {
        $report | Sort-Object EndsUtc |
            Export-Csv -Path './expiring-saml-certificates.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) SAML signing certificates end within $days days."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

Each row is 1 certificate, the soonest end first, and a negative DaysLeft has already ended. Certificate is the subject name, and NotifyTo the addresses Entra ID warns. An app can hold a new, inactive certificate beside the active one, so a row can be a certificate already replaced: check which is Active in the admin centre. To include older SAML apps with no single sign-on mode set, remove -Filter $filter: every service principal comes back, which takes longer, and the script still keeps only those with a signing certificate. Change $days for another window.

Option 2

Check SAML certificates in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Enterprise apps > All applications and select the application.
3. Under Manage, select Single sign-on, then find the SAML Certificates heading.
4. Select its Edit icon to open SAML Signing Certificate, which shows each certificate's status, expiration date and thumbprint, and the notification email addresses.
5. Close the page without creating, activating or saving anything.

This suits 1 app you already have in mind. Each app has its own page, so for every SAML app at once, use PowerShell or a report.

Common questions

What happens when a SAML certificate expires?

An app that checks the certificate's expiry stops accepting sign-ins signed with it. An app that doesn't check keeps working, which is no reason to leave it. To renew without an outage, create the new certificate with a date that overlaps the old one, give it to the app, then make it active.

Who gets the expiry emails?

By default only the administrator who added the app. You can list up to 5 addresses on SAML Signing Certificate, so use a distribution list to reach more people. If the addresses were set with Microsoft Graph or PowerShell, Microsoft says to confirm them in the admin centre, or the emails might not be sent.

What about secrets and certificates on app registrations?

They expire too, and break the apps that sign in with them. See how to find expiring app secrets; the Altivane tables above list both kinds together.