Further refined to include application name and date of expiry, also sets minimum date value to 0 to avoid already expired certificates appearing

ServicePrincipals[?preferredTokenSigningKeyEndDateTime != null && time_until(preferredTokenSigningKeyEndDateTime, 'days') < '30' && time_until(preferredTokenSigningKeyEndDateTime, 'days') > '0' ].['Application Name: 'displayName, 'Certificate Expiry: 'preferredTokenSigningKeyEndDateTime]

When used the above metric it shows error "ParserError: Invalid token (Number): "30"

null

You’ll need to wrap the number in backticks to pass it as a valid RoarPath value.

Correct Metric Query :

ServicePrincipals[?preferredTokenSigningKeyEndDateTime != null && time_until(preferredTokenSigningKeyEndDateTime, 'days') < ].displayName