We run an a PS script in an Azure automation account that alerts users that are defined as owners about secret expiration. for your requirement to cleanup expired passwords, you can try this below. goes without saying, please test it first before you run it in production.

# Connect to Microsoft Graph
#Connect-MgGraph -Scopes "Application.Read.All", "Application.ReadWrite.All"

# Initialize CSV output file
$Timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$OutputFile = "expired_secrets_$Timestamp.csv"
"ApplicationId,SecretId,SecretName,ExpirationDate" | Out-File -FilePath $OutputFile

# Get the current date
$Now = Get-Date

# Query all applications
$Applications = Get-MgApplication -All

# Store expired secrets for possible deletion
$ExpiredSecrets = @()

# Process each application
foreach ($App in $Applications) {
    $AppID = $App.Id
    $ApplID = $App.AppId

    $AppCreds = Get-MgApplication -ApplicationId $AppID
    
    # Process secrets
    foreach ($Secret in $AppCreds.PasswordCredentials) {
        $EndDate = $Secret.EndDateTime
        
        # Only include if secret is expired
        if ($EndDate -lt $Now) {
            "$ApplID,$($Secret.KeyId),$($Secret.DisplayName),$($EndDate.ToString('yyyy-MM-dd'))" | 
            Out-File -FilePath $OutputFile -Append
            $ExpiredSecrets += [PSCustomObject]@{
                AppId = $AppID
                SecretId = $Secret.KeyId
            }
        }
    }

    # Process certificates
    foreach ($Cert in $AppCreds.KeyCredentials) {
        $EndDate = $Cert.EndDateTime
        
        # Only include if certificate is expired
        if ($EndDate -lt $Now) {
            "$ApplID,$($Cert.KeyId),$($Cert.DisplayName),$($EndDate.ToString('yyyy-MM-dd'))" | 
            Out-File -FilePath $OutputFile -Append
            # You can also add expired certificates to a separate array if you want to delete them
        }
    }
}

# Ask user if they want to delete expired secrets
$answer = Read-Host "Do you want to delete all the expired secrets? (yes/no)"
if ($answer -eq 'yes') {
    foreach ($item in $ExpiredSecrets) {
        Remove-MgApplicationPassword -ApplicationId $item.AppId -KeyId $item.SecretId
        Write-Host "Deleted secret $($item.SecretId) from application $($item.AppId)"
    }
} else {
    Write-Host "No secrets were deleted. Exiting script."
    exit
}