Skip to content
AscendCore
Back to Runbook Library
Identity Live in production

Service Account Credential Rotation

Find Entra ID app secrets nearing expiry and rotate them with approval: a fresh secret is added, expired credentials are cleaned up, and the new value is retrieved once from the dashboard, never posted to chat.

Integrates with

Entra ID

The problem

Service-account secrets tend to live far longer than they should. Rotation is fiddly and risky to do by hand, so it gets deferred, and long-lived credentials become a finding in the next audit.

What AscendCore does

On demand from Slack or Teams, AscendCore scans your Entra ID app registrations for client secrets expiring within a chosen window (or already expired) and proposes the set on a single review card. On approval it ADDS a fresh secret to each reviewed app and cleans up credentials that are already expired. The still-valid old secret is left to lapse on its existing expiry, so the consuming service keeps working until you cut it over: the cutover itself stays with you, deliberately.

The new secret value never appears in Slack, Teams, email, or the audit log. It is sealed for one-time retrieval and you fetch it exactly once from the dashboard, within a short window; the retrieval itself is recorded on the tamper-evident audit chain alongside the rotation decision.

Status

Live in production. Rotates client secrets on real Microsoft Entra ID app registrations today from Slack and Teams: it scans for secrets nearing expiry, adds a fresh secret to each reviewed app on approval, and cleans up already-expired credentials, leaving the still-valid old secret to lapse so your cutover stays deliberate. The new value never touches chat or the audit log; it is sealed for a single dashboard retrieval, and that retrieval is itself recorded on the audit chain. Rotation requires a scoped Entra app credential with Application.ReadWrite.All and the dashboard sealing key configured; the expiry window and new-secret validity are configurable per customer.

Runbook source preview

Versioned, deterministic, auditable

Every runbook is defined as a versioned YAML manifest with explicit triggers, steps, and approval policies. The runbook itself is the audit-ready record of what AscendCore can and will do. Chat is just the interface that triggers it.

name: service-account-rotation
trigger:
  channels: [slack, teams]
  commands: [secret-rotation]
steps:
  - scan_expiring_secrets       # endDateTime within window, capped
  - admin_approval
  - add_new_secret              # re-verified per app at execution
  - remove_expired_credentials  # already-dead credentials only
  - one_time_dashboard_reveal   # the value never touches chat
approval:
  required: true
  approvers: [it-admins, sec-team]
Ready to deploy

Run service account credential rotation from Teams or Slack today

AscendCore deploys in days, not months for Slack + Okta or Teams + Entra stacks. See your first automated resolution the same day.