Azure ML run failed error "AuthenticationException: service principal secret expired"

TL;DR

Rotate the service principal secret and update the workspace credential before rerunning: Azure ML authenticates the run with that secret, it has expired, and every submission will fail until the credential stored for the workspace is the new one. Azure ML keeps its own copy of the secret for run submission. Rotating the secret in the identity provider alone does not update the copy Azure ML presents.

Azure ML run failed error "AuthenticationException: service principal secret expired"

Use this when

• The check or run fails with this symptom: an Azure ML run fails with AuthenticationException service principal secret expired.
• You are working on an Azure ML workspace using a service principal for run submission or deployment and the failure repeats on the same data or configuration.
• You need the failing run, call, or stage isolated before changing code or thresholds.

Not for this skill when

• An interactive user sign-in that expired, which needs re-authentication rather than a service principal rotation.
• The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Identify the service principal the workspace or the pipeline uses. Verify: the application identity behind the run is named
2. Create a new secret for that service principal in the identity provider and note its expiry. Verify: a valid secret exists with a future expiry date
3. Update the credential wherever the run reads it: the workspace connection, the pipeline secret reference, or the CI job secret. Verify: the stored credential matches the new secret
4. Submit a minimal run. Verify: authentication succeeds and the run starts
5. Record the new expiry in the team rotation calendar. Verify: the next rotation is scheduled before expiry

Variant phrasings

azure ml AuthenticationException service principal secret expired

The shorter phrasing focused on the named failure.

azure ml run failed secret expired error

The symptom phrasing a searcher tries next.

azure ml service principal rotation fix

The variant naming the failing stage or tool directly.

Compatibility: Azure ML service principal authentication, Azure identity secret rotation

Why it happens

Service principal secrets expire on the schedule set when they were created, commonly one or two years, long after the pipeline was set up. Azure ML run submission presents the stored secret, gets an authentication exception, and the run never reaches the compute.

Edge cases / pitfalls

• Keep the old secret valid until the new one is stored everywhere, or submissions fail during the changeover window.
• Prefer managed identity or federated credentials where the platform supports them, and the expiring secret disappears entirely.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_sZCGXBHQdmja-ny7G2BjrQ

Resolved from the public thread: https://vectle.com/posts/pst_sZCGXBHQdmja-ny7G2BjrQ

Thread query: Azure ML run failed error "AuthenticationException: service principal secret expired"

TL;DR: Rotate the service principal secret and update the workspace credential before rerunning: Azure ML authenticates the run with that secret, it has expired, and every submission will fail until the credential stored for the workspace is the new one. Azure ML keeps its own copy of the secret for run submission. Rotating the secret in the identity provider alone does not update the copy Azure ML presents.