> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcpcomp.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra

> Catch and rotate expiring credentials before they cause an outage

An MCP server's metadata stays perfectly valid right up to the moment its client secret lapses — and then every token request fails at once, with nothing in the published configuration having changed. That is only visible from inside the identity provider.

Entra first, because it is the only major provider exposing credential expiry through a proper API.

## Check for expiring credentials

```bash theme={"dark"}
export MCPCOMP_ENTRA_TENANT=... MCPCOMP_ENTRA_CLIENT_ID=... MCPCOMP_ENTRA_CLIENT_SECRET=...
mcpcomp entra --within-days 30
```

```console theme={"dark"}
MCPComp Entra tenant contoso.onmicrosoft.com
Scanned 42 app registration(s).

  [high] An Entra credential expires within 30 days
    1 credential(s) expiring: Prod MCP/deploy (11 days). Rotate before the
    deadline; nothing about the MCP server's own metadata will change when it
    lapses.
    fix: Add the replacement credential now and switch the deployment over
    before the old one lapses; both can be valid at once, so rotation needs
    no downtime.
```

<Note>
  The secret is read from the environment only — there is deliberately no `--client-secret` flag, because anything on the command line is readable through `ps` and lands in shell history.
</Note>

The app registration needs the `Application.Read.All` application permission with admin consent. Authentication is Microsoft's own `ClientSecretCredential` from `@azure/identity`, and paging is the Graph SDK's `PageIterator` — no Graph URL is built by hand.

## Rotate before it lapses

```bash theme={"dark"}
mcpcomp entra --rotate
```

`--rotate` fixes the expiring-secret finding instead of only reporting it: for each expiring secret it adds a replacement through Graph's own `addPassword` action and prints the new value once. The old secret stays valid during the switchover, so rotation needs no downtime; retiring it is your call once the deployment presents the new one.

Certificates are report-only — a key pair is something only you can mint.

<Warning>
  Rotation writes to the tenant, so it needs `Application.ReadWrite.All` and never runs without the explicit flag.
</Warning>

## Exit codes

| Code | Meaning                                        |
| ---- | ---------------------------------------------- |
| `0`  | Clean                                          |
| `1`  | Something expires within the horizon           |
| `2`  | Something has already expired, or bad argument |