Email reports on expiring Microsoft Entra ID app secrets and certificates with Microsoft Graph

by Alexander Schnabl ✓ · 347 views · created 2026-01-02 · DevOps

What this workflow does

This workflow has 16 nodes and runs manually, when you click “Execute workflow”. It uses only n8n's built-in nodes. It also calls graph.microsoft.com over HTTP.

How it runs

Trigger: Manually, when you click “Execute workflow”.

1. Set Variables (Edit Fields (Set)): sets 2 fields: notificationEmail, daysBeforeExpiry
2. Get EntraID Applications and Secrets (HTTP Request): calls graph.microsoft.com
3. Split Out: splits a list into separate items
4. Split Out: splits a list into separate items
5. Split Out: splits a list into separate items
6. Filter: keeps only the items that match a condition
7. Filter: keeps only the items that match a condition
8. Build Client Secrets Report (Edit Fields (Set)): sets 6 fields: applicationName, appId, type…
9. Build Certificates Report (Edit Fields (Set)): sets 6 fields: applicationName, appId, type…
10. Merge: merges the data from its input branches

…plus 4 more steps. See the full node list below.

HTTP calls to: graph.microsoft.com

Before you upgrade to n8n 3.0

Nodes used (11)

• Manual Triggern8n-nodes-base.manualTrigger
• Split Outn8n-nodes-base.splitOut
• Edit Fields (Set)n8n-nodes-base.set
• Mergen8n-nodes-base.merge
• Filtern8n-nodes-base.filter
• HTTP Requestn8n-nodes-base.httpRequest
• Aggregaten8n-nodes-base.aggregate
• Ifn8n-nodes-base.if
• No Operation, do nothingn8n-nodes-base.noOp
• HTMLn8n-nodes-base.html
• Send Emailn8n-nodes-base.emailSend

From the author

Monitor expiring EntraID application secrets and notify responsible Stay ahead of credential expirations by automatically detecting Entra ID application client secrets and certificates that are about to expire, and sending a neatly formatted email report.…

View the original on n8n.io → Check your own copy