How to gain Azure AppOnly persistent access

Question

Microsoft suggests Client credentials provider for my needs.

But I need to update the app secret by hand in the Azure dev web portal because max expiration time I can set is 2 years. How can I gain an infinite token or way to renew it programmatically?

(like in discord apps, why it is so complicated in Microsoft)

I expect I run my programs without additional interference.

Answer 1

How can I gain an infinite token or way to renew it programmatically?

AFAIK, there is no way to gain an infinite or way to renew the Application client secret.

As you said, In the portal the maximum expiration time of a client's secret can be set is 2 years only.

As a workaround, you can make use of the below javascript code to create a client secret with more lifetime.

For the sample I created a secret with 12 years expiry.

Code:

const { DefaultAzureCredential } = require("@azure/identity");
const { Client } = require("@microsoft/microsoft-graph-client");
const { TokenCredentialAuthenticationProvider } = require("@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials");

const credential = new DefaultAzureCredential();
const authProvider = new TokenCredentialAuthenticationProvider(credential, {
  scopes: ['https://graph.microsoft.com/.default'],
});
const client = Client.initWithMiddleware({
    debugLogging: true,
    authProvider,
});

const startDate = new Date();
const endDate = new Date(startDate);
endDate.setFullYear(endDate.getFullYear() + 12);

const passwordCredential = {
  passwordCredential: {
    displayName: 'test',
    startDateTime: startDate,
    endDateTime: endDate,
  }
};

async function updatePasswordCredentials() {
    const result = await client.api('/applications/<Your-Application-object-id>/addPassword')
    .post(passwordCredential);
    console.log(result);
}

updatePasswordCredentials();

Output:

https://graph.microsoft.com/v1.0/applications/xxxx/addPassword
(node:21972) ExperimentalWarning: The Fetch API is an experimental feature. This feature could change at any time
(Use `node --trace-warnings ...` to show where the warning was created)
{
  '@odata.context': 'https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.passwordCredential',
  customKeyIdentifier: null,
  displayName: 'test',
  endDateTime: '2036-01-02T09:40:39.584Z',
  hint: 'uXf',
  keyId: '3624xxxx00',
  secretText: 'uXf8Q~NDCpJuZkxxxxx',
  startDateTime: '2024-01-02T09:40:39.584Z'
}

Portal:

Reference:

• application: addPassword - Microsoft Graph v1.0 | Microsoft Learn
• Azure App registration Client secrets expiration - Stack Overflow by Daniel James Bryars.