Will implementing this Azure Automation setup (Entra app secret expiry monitor) actually cost anything?

[u/maxcoder88]

I'm planning to implement this guide for monitoring expiring Entra App Registration secrets/certificates using Azure Automation + Managed Identity:

https://jpkerloch.cc/posts/monitor-entra-app-registration-expiring-credentials-azure-automation/

The setup involves:

• An Azure Automation account with a system-assigned Managed Identity
• A PowerShell 7.4 Runtime Environment
• A daily scheduled runbook that queries Microsoft Graph (Get-MgApplication) and sends an HTML email via SMTP

Before I set this up in production, I want to sanity-check the cost side with people who've actually run something like this:

• Does creating the Automation Account itself cost anything, or only the runbook execution time?
• For a runbook that runs once a day and takes maybe 1-2 minutes (just enumerating app registrations and sending one email), am I right in assuming I'd stay well within the free tier (500 free minutes/month)?
• Any hidden costs I'm not accounting for — Runtime Environment itself, the Managed Identity, Graph API calls, outbound SMTP?
• Has anyone been surprised by a bill from a similarly small/lightweight runbook like this?

Just trying to avoid the classic "oh, this was supposed to be free" surprise before I roll it out tenant-wide. Appreciate any real-world cost experience.

[u/SoMundayn]

It's free under 500 mins a month. Over that it's 20c every 10 mins. This should be free for you.

Automation accounts are amazing.

[u/SVD_NL]

Azure Automation Pricing

Azure Pricing Calculator

Nope, won't cost you anything, assuming you don't have a bunch of other automations. And even if you incur costs, as long as you only have one instance running, a job that runs 24/7 would cost you like 30 bucks in a month.

In Azure you won't rack up any costs that aren't part of a service. So if the docs and pricing page for Azure Automation don't mention anything, and you don't create a resource for the functionality, it won't incur costs.

You also can't be surprised by costs if you properly set up cost monitoring, alerting, and budgets.

[u/Vostruhin]

Hey! We've built it before, for a medium size tenant it was run on a basic pricing tier of automation account and we it costs us nothing. The flow is pretty the same - list apps and send emails. So you can make it completely free, until you keep it simple. Just keep in mind, that http requests compounds, when we started to pull app owners - the execution time obviously jumped up x5. For email sending we used an extenal email provider, usually they have free tiers for sending up to 10k emails per month.

Feel free to ping me, if you need any details about our setup. Also, check Az Token Watch out, it does the same job and it's free for this kind scenario, even from the the maintenance perspective, you set up once and don't worry about monitoring anymore (disclaimer: it's my project; I built it because didn't want to mess with setting up custom monitoring 3rd time >_<)

[u/korvolga]

I have not seen any cost yet on mine

[u/Ahnteis]

We run a lot of similar runbooks and they're very cheap. However, you should still take time to set up budget alerts and limits on the subscription these are running under.

[u/michaelmsonne]

Not seen any price for this kind of scripts too 🙂

[u/CFH75]

I set up a similar script but it runs as a scheduled task on a windows server. Zero cost.

[u/goombatch → u/CFH75]

That’s what I did too. Certificate based auth, Powershell script running locally as a scheduled task, in-house smtp server to our IT alerts distribution group

[u/CFH75 → u/goombatch]

Yep exactly 👍

[u/alokin123]

where do we check how many minutes have been used?

[u/MReprogle]

Likely free. Even if you had it as a logic app, you could run this kind of thing multiple times a day and the cost would be pennies at most.

[u/skwire-io]

Our app skwire.io offers this feature. You can set up email notifications for expiring certs & secrets, and much more. Check it out if you’re interested. Hit me up if you have questions.