Trying to list all the certificates and secrets that are expired or going to expire in all applications

Working on obtaining the list of all the secrets and certificates that have either expired or are about to expire across all applications in Azure. However, I'm getting the error message below in the automation runbook, even though it ran successfully and gave me the expected results in PowerShell.

Error

Error - After successful running of PS script

Connect-AzAccount -Identity

# Get the current date and the date 30 days from now
$currentDate = Get-Date
$expiryDate = $currentDate.AddDays(30)

# Function to check expiration of secrets and certificates
function Check-Expiration {
    param (
        [Parameter(Mandatory=$true)]
        [string]$appId
    )

    # Get the application
    $app = Get-AzADApplication -ObjectId $appId

    # Initialize an array to store the results
    $results = @()

    # Check secrets
    $secrets = $app.PasswordCredentials
    foreach ($secret in $secrets) {
        if ($secret.EndDate -lt $currentDate) {
            $results += [PSCustomObject]@{
                'Type'        = 'Secret'
                'ID'          = $secret.KeyId
                'Application' = $app.DisplayName
                'AppID'       = $app.ObjectId
                'Status'      = 'Expired'
                'ExpiryDate'  = $secret.EndDate
            }
        } elseif ($secret.EndDate -le $expiryDate) {
            $results += [PSCustomObject]@{
                'Type'        = 'Secret'
                'ID'          = $secret.KeyId
                'Application' = $app.DisplayName
                'AppID'       = $app.ObjectId
                'Status'      = 'Expiring Soon'
                'ExpiryDate'  = $secret.EndDate
            }
        }
    }

    # Check certificates
    $certificates = $app.KeyCredentials
    foreach ($certificate in $certificates) {
        if ($certificate.EndDate -lt $currentDate) {
            $results += [PSCustomObject]@{
                'Type'        = 'Certificate'
                'ID'          = $certificate.KeyId
                'Application' = $app.DisplayName
                'AppID'       = $app.ObjectId
                'Status'      = 'Expired'
                'ExpiryDate'  = $certificate.EndDate
            }
        } elseif ($certificate.EndDate -le $expiryDate) {
            $results += [PSCustomObject]@{
                'Type'        = 'Certificate'
                'ID'          = $certificate.KeyId
                'Application' = $app.DisplayName
                'AppID'       = $app.ObjectId
                'Status'      = 'Expiring Soon'
                'ExpiryDate'  = $certificate.EndDate
            }
        }
    }

    # Return the results
    return $results
}

# Get all applications
$applications = Get-AzADApplication -All $true

# Initialize an array to store all results
$allResults = @()

# Check each application and collect results
foreach ($app in $applications) {
    $allResults += Check-Expiration -appId $app.ObjectId
}

# Output the results in a table format with dotted line separation
$allResults | Format-Table -AutoSize | Out-String | ForEach-Object { $_; "----------------------------------------" }

I do agree with CraftyB for suggesting the same point.

You can try the Get-AzADApplication without the -All parameter. Here is the updated script to fetch the Azure AD application secrets and certificates that are going to expire in 30 days.

Connect-AzAccount -Identity

$appList = Get-AzADApplication
$currentDate = Get-Date
$expiryThreshold = $currentDate.AddDays(30)


$output = @()


foreach ($app in $appList) {
    
    $appcred = Get-AzADAppCredential -ObjectId $app.Id
    
   
    $appName = $app.DisplayName

    
    foreach ($cred in $appcred) {
        
        $endDate = $cred.EndDateTime
        $displayName = $cred.DisplayName

        if ($endDate -eq $null) {
            $output += [pscustomobject]@{
                AppName      = $appName
                DisplayName  = $displayName
                ExpiryStatus = "No expiry date available"
                ExpiryDate   = ""
            }
            continue
        }

        
        if ($endDate -lt $currentDate) {
            $output += [pscustomobject]@{
                AppName      = $appName
                DisplayName  = $displayName
                ExpiryStatus = "Expired"
                ExpiryDate   = $endDate
            }
        }
        elseif ($endDate -lt $expiryThreshold) {
            $output += [pscustomobject]@{
                AppName      = $appName
                DisplayName  = $displayName
                ExpiryStatus = "Expiring in less than 30 days"
                ExpiryDate   = $endDate
            }
        }
        else {
            $output += [pscustomobject]@{
                AppName      = $appName
                DisplayName  = $displayName
                ExpiryStatus = "Not expiring in the next 30 days"
                ExpiryDate   = $endDate
            }
        }
    }
}

$output | Format-Table -Property AppName, DisplayName, ExpiryStatus, ExpiryDate

Output:

Automation account result