CredHound
CredHound tracks credential and certificate expiry across Microsoft Entra and Azure Key Vault, so nothing rotates late because nobody was watching.
Credential expiry was a blind spot until something broke.
Application registrations, Enterprise app service principals, SAML certificates, and Key Vault secrets, certificates, and keys accumulate across a tenant faster than any team can track by hand. Ownership gets lost, expiry dates go unwatched, and the first sign of a problem is often an outage.
- Credentials expire silently across multiple object types - app registrations, Enterprise apps, SAML certificates, and Key Vault objects - with no unified view of what’s expiring and when.
- Orphaned credentials with no clear owner go untracked, since nothing forces a review before an app registration or service principal is abandoned.
- Alert volume becomes noise without grouping or severity structure, making it hard to tell an Expired finding from a Warning at a glance.
- Audit trails drift when historical alerts get recalculated against today’s date instead of preserving the severity and days-left value from when the finding was generated.
Subscribe, connect, and let the scans run.
Subscribe, establish the CredHound organization, grant tenant consent, and run the first scan. Trial and subscription status controls whether new scans can run, but existing inventory remains visible for review.
Subscribe
Choose a CredHound plan from Microsoft Azure Marketplace.
Sign in
Choose Email address for Yahoo or other non-federated email accounts, Personal Microsoft account for Hotmail, Outlook.com, or Live.com, or Work or school account for organization users.
Activate
Confirm organization, administrator email, and subscription.
Grant consent
A target-tenant Global Administrator or Cloud Application Administrator approves read-only Graph access.
Scan
The initial app-registration scan is queued; recurring daily scans run automatically.
Connect Key Vault
Eligible plans deploy read-only Azure RBAC, discover vaults, and select objects to monitor.
Act
Review expiry severity and configure alert recipients.
Report
Download inventory or use full month/year reporting on Professional and above.
Nine workstreams, one expiry picture.
CredHound has expanded from basic app registration and Key Vault expiry scanning into clearer Entra expiry tracking, richer alert evidence, Jira-backed customer feedback, and stronger access-management controls.
Dashboard
Expired and expiring-soon findings, identified down to the object.
Expired and expiring-soon tables show app/client ID, object ID where applicable, and secret or certificate key ID so administrators can identify the exact object to rotate. Tenant detail views use expiry findings language and distinguish app registrations, Enterprise apps/service principals, SAML certificates, Key Vault objects, and no-owner findings where enabled by plan.
Subscription and plans
One Marketplace subscription sets tenant, app, vault, and object capacity.
One Marketplace SaaS subscription creates a CredHound organization. The selected plan determines connected-tenant, monitored-app, selected-vault, and Key Vault object capacity, and controls feedback, scan scheduling, reporting entitlements, and whether new manual or scheduled scans can run. One Key Vault object means one monitored secret, certificate, or key; object versions are not presented as separate inventory items. When a trial or subscription has ended, CredHound keeps previous findings visible but blocks new manual and scheduled scans until the organization upgrades or reactivates.
Microsoft Entra
Read-only, consent-gated scanning of app registrations and service principals.
A Microsoft Entra administrator enters the target directory ID and grants the scanner app read-only application and directory permissions. CredHound records the connected tenant only after consent succeeds. The scanner reads metadata for app registrations, service principals, Enterprise apps, and related credential records where the subscription tier enables that coverage. Marketplace identity and tenant consent are separate: a personal Microsoft account can purchase and use CredHound, but it cannot grant tenant-wide scanner permissions from its personal directory.
Azure Key Vault
Read-only RBAC discovery of vaults and objects, explicitly selected by an administrator.
Standard and higher plans can add Azure Key Vault monitoring. CredHound deploys read-only Azure RBAC assignments, discovers eligible vaults, and lets an owner or administrator select which vaults and objects are included. The deployment assigns Reader and Key Vault Reader, and reads resource and object metadata, never secret, certificate, or key values. Each selected secret, certificate, or key counts as one Key Vault object, with versions remaining part of the same inventory item.
Operations
Daily scans by default, with on-demand runs and configurable intervals on higher plans.
CredHound queues app-registration scans after tenant onboarding and Key Vault scans after vault selection. Recurring scans run daily by default, and authorized customer users can run scans on demand. Professional, Business, and Enterprise administrators can choose 6-hour, 12-hour, daily, two-day, three-day, or weekly recurring intervals and can pause recurring scans. Expired trials and inactive subscriptions stop new scan creation while leaving the last successful inventory available.
Notifications
Grouped, timezone-aware alerts with delivery evidence.
The in-product alert inbox and Azure Communication Services notify configured recipients about expiring app credentials and Key Vault objects. CredHound records whether each email was queued, sent, or failed, along with its recipient and timestamps. Expired, Critical, and Warning findings can be sent as grouped emails per recipient and severity, and expiry emails show the configured local timezone first with UTC beneath it.
Evidence and reporting
A current inventory CSV on every plan; full month/year reporting on Professional and above.
Organization owners and administrators can download a current inventory report. Professional, Business, and Enterprise plans also include period-based operational reporting with month and year filters, covering credential health, scan frequency, sign-in totals, email delivery, and user activity. Print-friendly reports can be saved as PDF, and CSV exports cover applications, Key Vault metadata, scans, alerts, and users, with negative days-left values exported for already-expired credentials.
Customer support
Feedback routes to AIM’s Jira, with status visible back inside CredHound.
Standard and higher plans can submit suggestions, issues, errors, and other feedback from the product, with a tenant attached when the feedback concerns a specific environment. Feedback creates Jira-backed tickets for AIM to triage, while customers see the ticket status and a customer-visible AIM response inside CredHound. Starter organizations use the support channel instead of the in-product feedback form.
Access control
Protected ownership, role-based access, and confirmation-gated deletion.
The Marketplace purchaser becomes the protected organization owner. Owners and administrators manage the organization; viewers receive read-only access. The last active administrator is protected from disablement or deletion. Customer invite emails include the recipient name, inviter, organization, assigned role, access summary, and acceptance prompt.
A single, current picture of what’s about to expire.
Every credential type CredHound covers is scanned on a schedule, scored by severity, and routed to the right recipient, with an inventory that stays visible even when a subscription lapses.
Expiry coverage spans app registrations, Enterprise apps/service principals, SAML certificates, and Key Vault objects, with no-owner findings surfaced where the plan enables it.
Access to Microsoft Entra and Azure Key Vault is read-only throughout: scanner permissions read metadata only, and no secret, certificate, or key value is ever stored or extracted.
Alerts preserve the severity and days-left value from the moment they were generated, so the historical record does not drift when reviewed later.
Reporting scales with the plan, from a single current inventory CSV on Starter and Standard to full month/year operational reporting on Professional and above.
Built for review, not just alerting.
Read-only by design
Scanner and Key Vault access is metadata-only. CredHound never reads, stores, or extracts a secret, certificate, or key value.
Evidence, not just alerts
Scan status, delivery state, and organization activity are recorded with actors, targets, and timestamps, ready to support a review rather than just a notification.
Compliance-aware, not compliance-claiming
Controls can support an ISO 27001, SOC 2, or GDPR program, but CredHound is described as certified or compliant only alongside the organization-wide governance and audit work that certification actually requires.