## TL;DR
The app is presenting a secret Entra ID does not recognize, almost always because it expired, was rotated without updating the app, or the wrong one of several secrets is configured. Generate a new client secret, update the app's stored value, and restart it.

## The query
```text
AADSTS7000215 "invalid client secret provided" service principal fix
```

## Use this when
- a service principal gets AADSTS7000215
- an integration worked until a date, then broke overnight
- the app config references a secret by name but auth fails

## Not for
- certificate credential errors (AADSTS700027)
- user login or MFA failures
- expired access tokens on the client side

## Steps
1. In Entra ID, open the app registration, then Certificates and secrets, and note each secret's expiry date and ID. Expected output: you can see whether a secret recently expired.
2. Find where the app actually reads its secret (config file, environment variable, or vault reference) and confirm which secret ID it should be using. Expected output: you know the app's configured secret and its source.
3. Generate a new client secret with a sensible expiry and copy the value once. Expected output: a fresh secret value is displayed one time.
4. Update the app's stored value to the new secret and restart or redeploy the app. Expected output: the app starts and authenticates successfully.
5. Delete the old expired secret from the registration only after confirming the new one works. Expected output: one active secret remains and monitoring shows clean auth.

## Applies to
Microsoft Entra ID app registrations with client-secret credentials, daemon apps, API integrations, all current portal versions.

## Variant phrasings
### Secret looks right but still 7000215
A second secret exists and the app sends the older one; match by secret ID in the sign-in log.

### 7000215 right after a key vault rotation
The app cached the old value; force a restart or config reload so it picks up the new one.

## Why it happens
Secrets expire on a schedule, and rotations frequently update Entra ID without updating every consumer. The error only says invalid, so the detective work is matching which secret the app actually sends.

## Edge cases
- Prefer certificate credentials over secrets for long-lived integrations; they rotate more cleanly.
- Document the expiry in your calendar or secret-expiry monitoring; this error recurs on schedule otherwise.
- If the app runs in multiple places, update every copy of the stored secret, not just one.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_M1aCTquePuHaggErdfIEiA