Home › Knowledgebase › Rotating App Registration Credentials
Knowledgebase

Rotating App Registration Credentials

How to renew expiring client secrets across Alira’s per-module App Registrations in Microsoft Entra — keeping each module connected and operational.

~5 min read
Settings › Module Settings
Required for all modules

Overview

Alira creates a separate App Registration in Microsoft Entra for each module — Access Portal, Licence Portal, and Extended Identities. This ensures that API permissions are scoped precisely to what each module needs, with no shared credentials across modules.

Each App Registration uses a client secret to authenticate. Client secrets expire — typically after 12 or 24 months depending on the expiry date set when the secret was created. When a secret expires, the affected module will lose connection to your Entra tenant and stop functioning until the credentials are renewed.

What you’ll need

Access to Microsoft Entra ID (Entra Portal → App registrations) and Global Administrator or Application Administrator privileges in your tenant. You’ll also need access to the relevant module’s Settings page in Alira.

How it works

The process is the same for each module — find the App Registration using the Client ID shown in Alira’s Settings, create a new secret in Entra, copy the value, and paste it back into Alira with the updated expiry date.

Enable — Access Portal Pro — Licence Portal Ultimate — Extended Identities
⚠ Do not delete the old secret before saving the new one. Create the new secret first, update Alira, confirm the module is working, then delete the old secret. Deleting first will immediately break the connection.
Note: The steps below use the Client ID shown in Alira’s module Settings page to locate the correct App Registration in Entra. Each module has a different Client ID — make sure you’re rotating the right one.
1

Access Portal Enable plan

Navigate to Access Portal → Settings in Alira and note the Client ID — you’ll use this to find the correct App Registration in Entra.

Home › Access Portal › Settings
Access Portal Settings showing Client ID

Find the App Registration in Entra

  1. Go to Microsoft Entra ID → App registrations
  2. Select All applications and paste the Client ID from Alira into the search box
  3. Select the matching App Registration from the results
Alira — Settings › Access Portal › Connection Details
Access Portal Settings showing Client ID

Create a new client secret

  1. In the App Registration, go to Certificates & secrets → Client secrets
  2. Click + New client secret
  3. Enter a description (e.g. Alira key 2) and choose an expiry period — 12 or 24 months is recommended
  4. Click Add
  5. Immediately copy the Value shown in the table — this is only visible once. If you navigate away, you’ll need to create another secret.
⚠ Copy the secret value immediately. Once you navigate away from this page the full value is masked and cannot be retrieved. You must copy it before closing or refreshing.

Update Alira with the new credentials

  1. Return to Alira → Settings → Access Portal → Settings
  2. Paste the new secret value into the Client Secret field
  3. Update the Credential Expiration date to match the expiry you set in Entra
  4. Click Save
  5. Confirm the Access Portal is working — browse to the Requests or Applications view and verify data loads correctly
  6. Once confirmed, return to Entra and delete the old secret
Done. The Access Portal module is now connected using the new credentials.
2

Licence Portal Pro plan

Navigate to Settings → License Management → Settings in Alira and note the Client ID.

Find the App Registration in Entra

  1. Go to Microsoft Entra ID → App registrations
  2. Select All applications and paste the Licence Portal Client ID from Alira into the search box
  3. Select the matching App Registration — it will be named something like Your Org — License Management — (date)
Entra — App registrations search by Client ID
Searching Entra App Registrations by Client ID

Create a new client secret

  1. In the App Registration, go to Certificates & secrets → Client secrets
  2. Click + New client secret
  3. Enter a description and choose your preferred expiry period
  4. Click Add
  5. Immediately copy the Value — visible once only

Update Alira with the new credentials

  1. Return to Alira → Settings → License Management → Settings
  2. Paste the new secret value into the Client Secret field
  3. Update the Credential Expiration date
  4. Click Save
  5. Confirm the Licence Portal is working — check that the Dashboard or Licences view loads data
  6. Return to Entra and delete the old secret
Done. The Licence Portal module is now connected using the new credentials.
3

Extended Identities Ultimate plan

Navigate to Settings → Extended Identities → Settings in Alira and note the Client ID.

Find the App Registration in Entra

  1. Go to Microsoft Entra ID → App registrations
  2. Select All applications and paste the Extended Identities Client ID into the search box
  3. Select the matching App Registration from the results

Create a new client secret

  1. In the App Registration, go to Certificates & secrets → Client secrets
  2. Click + New client secret
  3. Enter a description and choose your preferred expiry period
  4. Click Add
  5. Immediately copy the Value — visible once only

Update Alira with the new credentials

  1. Return to Alira → Settings → Extended Identities → Settings
  2. Paste the new secret value into the Client Secret field
  3. Update the Credential Expiration date
  4. Click Save
  5. Confirm Extended Identities is working — check that Companies or Guests load correctly
  6. Return to Entra and delete the old secret
Done. The Extended Identities module is now connected using the new credentials.

Tips & Reminders

Set a calendar reminder

Client secrets don’t send expiry alerts by default. Set a calendar reminder 30 days before the Credential Expiration date shown in each module’s Settings to give yourself time to rotate before the connection drops.

Each module is independent

Alira uses a separate App Registration per module — rotating the Access Portal secret does not affect the Licence Portal or Extended Identities, and vice versa. Rotate each module independently.

The Client ID never changes

Only the Client Secret and Credential Expiration need updating. The Tenant ID and Client ID remain the same — you don’t need to recreate the App Registration.

Naming your secrets

Use a clear naming convention when creating secrets — for example Alira key 2, Alira key 3 — so you can easily identify which is the current active secret when it’s time to rotate again.

If a module stops working after rotation — double check that you copied the full secret Value (not the Secret ID) and that the Credential Expiration date in Alira matches what you set in Entra. Re-save the settings and test again.
© 2026 Kocho Group Ltd · Registered in England & Wales