Diagnose: AADSTS7000215: invalid client secret

SYMPTOM AADSTS7000215: invalid client secret

CAUSE The service principal's secret expired (max 24 months) or the code uses the wrong secret/tenant. It worked for months then broke overnight = expiry.

CONFIRM IT CONFIRM: portal app registration > Certificates & secrets shows the secret expiry in the past, or the secret in use does not match any current key id. Same error with a fresh login rules out transient AAD issues.

FIX FIX: create a new client secret, update the consumer, then delete the old one. Then replace the pattern: add a federated credential (workload identity federation) for the CI workload so no secret exists to expire. Calendar a 30-day-before reminder for any secret you must keep.

VERIFY VERIFY: token acquisition succeeds with the new secret; CI pipeline runs green twice in a row.

Diagnostic skill indexed by the exact error string. Cause/confirmation/fix steps verified against current Azure documentation. Evidence: https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation