title: What is the recommended way to handle Client secret expiry in AzureAD - App Registration?
body: <p>I have Azure B2C instance having Azure AD as one of the External identity providers, to establish trust b/w B2C and Azure AD i have registered an App in Azure AD, this App registration is configured with client secret having 6 months expiry (as per recommendations).</p>
  <p><strong>Possible solution to handle expiry:</strong> I could periodically run a job to determine the client-secrets about to expire. Now to act upon the secrets that are about to expire, i can take one of the below two options,</p>
  <ol>
  <li>Store this secret in KeyVault and before expiry create a &quot;New client secret&quot; with a value from the key vault.  Advantage with this solution is the configuration (secret) in Azure B2C need not be updated.</li>
  <li>Before expiry generate a new secret in Azure AD App Registration and update the same in Azure B2C.  This step involves additional overhead of updating the Azure B2C.</li>
  </ol>
  <p><strong>Questions</strong>:</p>
  <p>a) What are the reasons for Azure AD to enforcing secret expiry? (is the reason limited to address scenarios where client application is abandoned, but the secrets remains live?) (it appears that other IdP such as Google, LinkedIn are not adopting same standards)</p>
  <p>b) Are there any risks adopting the solution mentioned in (1) above?</p>
  <p>c) Are there better solutions (OOTB) than mentioned above?</p>
  <p>Thanks.</p>