A client secret runs out, an Apple push certificate lapses, a DNS record is overwritten, and an integration, device enrollment or your mail stops in the middle of the night. GlacierPoint Remind lists everything in your Microsoft 365 tenant that can expire or break, names the owner of each item, and warns by mail a month, two weeks, a week and a day before it does.
You need a Windows computer and a Microsoft 365 administrator account. Details below.
How many items expire in the next 30 days, how many already expired, and the three nearest by name. Under it, one section per kind of item: where each one lives, its owner, its end date, the days left, what stops when it ends and what to do.
After a run
Example4 items expire in the next 30 days, 1 already expired.
Every row says what stops when it expires and what to do about it. contoso.com, an example tenant.
Each section of the report says, in one sentence, why it is checked, so that a record that never expires is never a surprise on an expiry report.
A secret or certificate has an end date. When it passes, every integration that signs in with it stops, usually without a warning from Microsoft.
When it breaks: sign-ins and API calls through the application stop.
Single sign-on to a third-party application relies on a signing certificate with an end date. When it passes, staff can no longer sign in to that application.
When it breaks: SAML sign-in to the application stops.
Microsoft warns the owners of an application before its credentials expire. An application with no owner warns nobody.
When it breaks: nobody is warned before its credentials expire.
An application nobody has used in a long time still holds working credentials. If one leaks, nobody notices. Confirm it is still needed or remove it.
When it breaks: a credential nobody uses stays an open door.
DNS records do not expire, but they break. A domain move, a new mail service or a rebuilt website can delete or overwrite them, and nobody notices until mail bounces or lands in spam. Remind reads the MX, SPF, DKIM and DMARC records as the Internet sees them and compares them with what Microsoft 365 expects, so a change shows here before it shows as lost mail.
When it breaks: mail from the domain bounces or lands in spam.
Apple and Google require a certificate or token that Microsoft cannot renew for you. When one expires, phones and laptops stop enrolling and can fall out of management.
When it breaks: device enrollment and management stop.
Directory synchronization copies on-premises accounts and password changes to Microsoft 365. When it stalls, new staff cannot sign in and password changes do not take effect in the cloud.
When it breaks: password changes and new users stop reaching the cloud.
A sign-in policy that still names a deleted user, group or application no longer applies to what it was meant for. Microsoft does not flag this.
When it breaks: the policy no longer applies to what it was meant for.
A Windows app does the reading with your own sign-in. The portal keeps the runs and shows them to your team.
Create your workspace with your work email: a six-digit code, no password. The free Preview starts at once.
Download the Windows app from the portal and start it. It shows a code, and an owner or operator of your workspace approves it.
Sign in to Microsoft with your administrator account. The app reads the eight sections, looks up your domains’ mail records, and sends the result to the portal sealed.
What expires in the next 30 days and what already expired, the three nearest named, then every item with its owner, the days left and what to do. As a page, a PDF and a CSV.
With Watch and MSP, the app runs every day on a computer of yours, and the portal mails 30, 14 and 7 days and 1 day before each end date and on the day.
Warning mail
ExampleThese items of Contoso expire soon or expire today:
Mark an item handled once it is renewed, or ignored with the reason, and its warnings stop.
A list of every secret in your tenant would be a fine target, so Remind keeps no secret at all: only what each item is, where it lives, who owns it and when it ends.
GlacierPoint Scan finds configuration weaknesses and sets priorities; GlacierPoint Snapshot preserves configuration history and recovers supported settings. Together: assess, capture the current configuration, make the approved changes, verify. GlacierPoint Remind keeps watch over what the tenant depends on and expires: secrets, certificates, tokens and records.
GlacierPoint Technologies builds tools that keep Microsoft 365 and Windows environments known, safe and recoverable.
We started from a simple observation: most organizations don't know where their directory and tenant stand until something goes wrong, and the tools that could tell them are written for specialists. Our products put a clear answer in front of the people who have to act on it — a brief a leadership team can read, evidence an administrator can verify, and changes you approve one at a time.
Plain-language reports and prices on the page. The same evidence sits behind every number.
You authorize every collection and every change. Nothing runs in your environment without your sign-in, and every change our tools make records a way back.
Evidence is encrypted on your computer before it leaves. We never train AI on customer data, and support sees your data only when you grant it, for as long as you choose.
Paid plans differ by how long they run, whether the app runs on a schedule and sends warnings, and how many tenants you look after. Never by what is checked.
One-time $49 per tenant for 30 days; Watch $9 per month, $108 a year billed in advance; MSP $79 a month plus $7 a month per tenant. See the plans
Every workspace starts as the free Preview. Compare the plans in full, with the MSP plan’s monthly totals worked out.
The free Preview runs up to 3 times on one tenant: the headline, every section with its counts, and the three nearest items of each. Decide with your own dates in front of you.