The problem
Service-account secrets tend to live far longer than they should. Rotation is fiddly and risky to do by hand, so it gets deferred, and long-lived credentials become a finding in the next audit.
What AscendCore does
On demand from Slack or Teams, AscendCore scans your Entra ID app registrations for client secrets expiring within a chosen window (or already expired) and proposes the set on a single review card. On approval it ADDS a fresh secret to each reviewed app and cleans up credentials that are already expired. The still-valid old secret is left to lapse on its existing expiry, so the consuming service keeps working until you cut it over: the cutover itself stays with you, deliberately.
The new secret value never appears in Slack, Teams, email, or the audit log. It is sealed for one-time retrieval and you fetch it exactly once from the dashboard, within a short window; the retrieval itself is recorded on the tamper-evident audit chain alongside the rotation decision.
Status
Live in production. Rotates client secrets on real Microsoft Entra ID app registrations today from Slack and Teams: it scans for secrets nearing expiry, adds a fresh secret to each reviewed app on approval, and cleans up already-expired credentials, leaving the still-valid old secret to lapse so your cutover stays deliberate. The new value never touches chat or the audit log; it is sealed for a single dashboard retrieval, and that retrieval is itself recorded on the audit chain. Rotation requires a scoped Entra app credential with permission to manage app registrations; the expiry window and new-secret validity are configurable per customer.
