Know what’s expiring, before it becomes an outage.
CredHound tracks credential and certificate expiry across Microsoft Entra and Azure Key Vault, covering app registrations, Enterprise apps, SAML certificates, and Key Vault objects from one dashboard.
Full credential coverage
App registrations, Enterprise apps and service principals, SAML certificates, and Key Vault objects, tracked from one dashboard.
Daily scans, on demand too
Recurring scans run daily by default. Professional, Business, and Enterprise plans can choose 6-hour, 12-hour, daily, two-day, three-day, or weekly intervals, or run a scan on demand.
Read-only, always
Scanner access to Entra and Key Vault is metadata-only. CredHound never reads, stores, or extracts a secret, certificate, or key value.
Credential expiry was a blind spot until something broke.
Application registrations, Enterprise app service principals, SAML certificates, and Key Vault secrets, certificates, and keys accumulate across a tenant faster than any team can track by hand. Ownership gets lost, expiry dates go unwatched, and the first sign of a problem is often an outage.
Credentials expire silently across multiple object types, with no unified view of what’s expiring and when.
Orphaned credentials with no clear owner go untracked, since nothing forces a review before an app registration or service principal is abandoned.
Alert volume becomes noise without grouping or severity structure, making it hard to tell an Expired finding from a Warning at a glance.
Audit trails drift when historical alerts get recalculated against today’s date instead of preserving the severity and days-left value from when the finding was generated.
From subscription to a scored, actionable finding.
Subscribe and connect
Choose a CredHound plan from Microsoft Azure Marketplace, then a target-tenant Global Administrator or Cloud Application Administrator grants read-only Graph access.
Scan
The initial app-registration scan is queued; recurring daily scans run automatically. Eligible plans can also connect Key Vault, discovering vaults and letting an administrator select which objects to monitor.
Act
Expired and expiring-soon findings show severity, and administrators configure alert recipients and grouping.
Report
Download a current inventory, or use full month/year reporting on Professional and above.
Built for review, not just alerting.
Identified down to the object
Expired and expiring-soon tables show app/client ID, object ID where applicable, and secret or certificate key ID, so an administrator knows exactly what to rotate.
Grouped, timezone-aware alerts
Expired, Critical, and Warning findings can be sent as grouped emails per recipient and severity, with the configured local timezone shown first and UTC beneath.
Evidence, not just alerts
Scan status, delivery state, and organization activity are recorded with actors, targets, and timestamps, and historical alerts preserve the severity and days-left value from when they were generated rather than recalculating against today’s date.
Read-only by design
The deployment assigns Reader and Key Vault Reader. CredHound reads resource and object metadata, never secret, certificate, or key values.
Compliance-aware, not compliance-claiming.
CredHound’s controls can support a customer or AIM compliance program, but the product is not described as ISO certified, SOC 2 compliant, or GDPR compliant without the corresponding organization-wide governance, assessment, and legal work.
ISO/IEC 27001
Role-based access, identity controls, operational logging, least privilege, and incident evidence can support an ISMS. Certification applies to the organization and defined scope after an independent audit.
SOC 2
Scan records, access controls, alert delivery, change management, monitoring, and incident response can become control evidence. A licensed CPA firm performs the examination.
GDPR
Data minimization, retention, access control, deletion workflows, subprocessors, legal basis, data subject handling, and records of processing are required. Technical logs alone are insufficient.
Get a current picture of every credential in your tenant.
Scored by severity and routed to the right recipient.