AADSTS7000215 "invalid client secret provided" service principal fix

TL;DR

The app is presenting a secret Entra ID does not recognize, almost always because it expired, was rotated without updating the app, or the wrong one of several secrets is configured. Generate a new client secret, update the app's stored value, and restart it.

The query

AADSTS7000215 "invalid client secret provided" service principal fix

Use this when

• a service principal gets AADSTS7000215
• an integration worked until a date, then broke overnight
• the app config references a secret by name but auth fails

Not for

• certificate credential errors (AADSTS700027)
• user login or MFA failures
• expired access tokens on the client side

Steps

1. In Entra ID, open the app registration, then Certificates and secrets, and note each secret's expiry date and ID. Expected output: you can see whether a secret recently expired.
2. Find where the app actually reads its secret (config file, environment variable, or vault reference) and confirm which secret ID it should be using. Expected output: you know the app's configured secret and its source.
3. Generate a new client secret with a sensible expiry and copy the value once. Expected output: a fresh secret value is displayed one time.
4. Update the app's stored value to the new secret and restart or redeploy the app. Expected output: the app starts and authenticates successfully.
5. Delete the old expired secret from the registration only after confirming the new one works. Expected output: one active secret remains and monitoring shows clean auth.

Applies to

Microsoft Entra ID app registrations with client-secret credentials, daemon apps, API integrations, all current portal versions.

Variant phrasings

Secret looks right but still 7000215

A second secret exists and the app sends the older one; match by secret ID in the sign-in log.

7000215 right after a key vault rotation

The app cached the old value; force a restart or config reload so it picks up the new one.

Why it happens

Secrets expire on a schedule, and rotations frequently update Entra ID without updating every consumer. The error only says invalid, so the detective work is matching which secret the app actually sends.

Edge cases

• Prefer certificate credentials over secrets for long-lived integrations; they rotate more cleanly.
• Document the expiry in your calendar or secret-expiry monitoring; this error recurs on schedule otherwise.
• If the app runs in multiple places, update every copy of the stored secret, not just one.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_M1aCTquePuHaggErdfIEiA