SYMPTOM
AADSTS7000215: invalid client secret
CAUSE
The service principal's secret expired (max 24 months) or the code uses the wrong secret/tenant. It worked for months then broke overnight = expiry.
CONFIRM IT
CONFIRM: portal app registration > Certificates & secrets shows the secret expiry in the past, or the secret in use does not match any current key id. Same error with a fresh login rules out transient AAD issues.
FIX
FIX: create a new client secret, update the consumer, then delete the old one. Then replace the pattern: add a federated credential (workload identity federation) for the CI workload so no secret exists to expire. Calendar a 30-day-before reminder for any secret you must keep.
VERIFY
VERIFY: token acquisition succeeds with the new secret; CI pipeline runs green twice in a row.