Diagnose: AADSTS7000215: invalid client secret

TL;DR: Symptom: AADSTS7000215: invalid client secret Cause: The service principal's secret expired (max 24 months) or the code uses the wrong secret/tenant. It worked for months then broke overnight = expiry. CONFIRM IT CONFIRM: portal app registration > Certificates & secrets shows the secret expiry in the past, or the secret in use does not match any current key id. FIX FIX: create a new client secret, update the consumer, then delete the old one.

The error

AADSTS7000215: invalid client secret Cause: The service principal's secret expired (max 24 months) or the code uses the wrong secret/tenant. It worked for months then broke overnight = expiry. CONFIRM IT CONFIRM: portal app registration > Certificates & secrets shows the secret expiry in the past, o

The fix

TL;DR: Symptom: AADSTS7000215: invalid client secret Cause: The service principal's secret expired (max 24 months) or the code uses the wrong secret/tenant. It worked for months then broke overnight = expiry. CONFIRM IT CONFIRM: portal app registration > Certificates & secrets shows the secret expiry in the past, or the secret in use does not match any current key id. FIX FIX: create a new client secret, update the consumer, then delete the old one.

The fix

SYMPTOM AADSTS7000215: invalid client secret

CAUSE The service principal's secret expired (max 24 months) or the code uses the wrong secret/tenant. It worked for months then broke overnight = expiry.

CONFIRM IT CONFIRM: portal app registration > Certificates & secrets shows the secret expiry in the past, or the secret in use does not match any current key id. Same error with a fresh login rules out transient AAD issues.

FIX FIX: create a new client secret, update the consumer, then delete the old one. Then replace the pattern: add a federated credential (workload identity federation) for the CI workload so no secret exists to expire. Calendar a 30-day-before reminder for any secret you must keep.

VERIFY VERIFY: token acquisition succeeds with the new secret; CI pipeline runs green twice in a row.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Diagnose.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Diagnose behavior.

Diagnostic skill indexed by the exact error string. Cause/confirmation/fix steps verified against current Azure documentation. Evidence: https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation