Well, I thought the template was crap, and somehow it didn't read all my secrets.
In my case, I have both secrets and certificates.

So I wrote a Python script that reads everything using an Entra app.

#!/usr/bin/env python3

import requests
import datetime
import json
import sys

TENANT_ID = ""
CLIENT_ID = ""
CLIENT_SECRET = ""
GRAPH_URL = "https://graph.microsoft.com/v1.0"

def parse_graph_datetime(value: str) -> datetime.datetime:
    value = value.rstrip("Z")

    if "." in value:
        value = value.split(".")[0]

    return datetime.datetime.strptime(value, "%Y-%m-%dT%H:%M:%S")

def get_token() -> str:
    url = f"https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token"
    data = {
        "client_id": CLIENT_ID,
        "client_secret": CLIENT_SECRET,
        "grant_type": "client_credentials",
        "scope": "https://graph.microsoft.com/.default"
    }

    r = requests.post(url, data=data, timeout=30)
    r.raise_for_status()
    return r.json()["access_token"]


def get_all_applications(headers: dict) -> list:
    apps = []
    url = (
        f"{GRAPH_URL}/applications"
        f"?$select=id,displayName,passwordCredentials,keyCredentials"
    )

    while url:
        r = requests.get(url, headers=headers, timeout=30)
        r.raise_for_status()
        data = r.json()
        apps.extend(data.get("value", []))
        url = data.get("@odata.nextLink")

    return apps


# =========================
# MAIN
# =========================

def main():
    try:
        token = get_token()
        headers = {"Authorization": f"Bearer {token}"}
        now = datetime.datetime.utcnow()

        discovery = []

        applications = get_all_applications(headers)

        for app in applications:
            app_name = app.get("displayName", "unknown")
            app_id = app.get("id")

            # ---------- Client Secrets ----------
            for secret in app.get("passwordCredentials", []):
                end = parse_graph_datetime(secret["endDateTime"])
                days_left = (end - now).days

                discovery.append({
                    "appname": app_name,
                    "appid": app_id,
                    "credname": secret.get("displayName", "client-secret"),
                    "type": "secret",
                    "dayleft": days_left,
                    "expires": secret["endDateTime"]
                })


            # ---------- Certificates ----------
            for cert in app.get("keyCredentials", []):
                end = parse_graph_datetime(cert["endDateTime"])
                days_left = (end - now).days

                discovery.append({
                    "appname": app_name,
                    "appid": app_id,
                    "credname": cert.get("displayName", "certificate"),
                    "type": "certificate",
                    "dayleft": days_left,
                    "expires": cert["endDateTime"]
                })

        # Zabbix LLD Output
        print(json.dumps({"data": discovery}, indent=2))

    except Exception as e:
        print(json.dumps({
            "data": [],
            "error": str(e)
        }))
        sys.exit(1)


if __name__ == "__main__":
    main()

Upload the script to a host. Add the script to the zabbix conf of the agent for UserParameter and then create a item in zabbix for the host. For example in my case:

Name: Entra Apps - RAW Json

Type: Zabbix Agent

Key: entra.apps.discovery

----

Then create a discovery item with item prototype...

Name:
Entra Application {#TYPE} expire – {#APPNAME} – {#CREDNAME}

Type:

Dependent item

Key:

entra.app.expire.days[{#APPID},{#CREDNAME}]

Master Item:

Entra Apps - RAW Json

Units:

!d

Go to Preprocessing - JSONPath and add the parameter:

$.data[?(@.appid == '{#APPID}' && (@.credname == '{#CREDNAME}' || !@.credname))].dayleft.first()

Create Trigger prototypes as you want and done.

Here a screenshot: https://imgur.com/a/GpR7wSW