**TL;DR:** Symptom: AADSTS7000215: invalid client secret Cause: The service principal's secret expired (max 24 months) or the code uses the wrong secret/tenant. It worked for months then broke overnight = expiry. CONFIRM IT CONFIRM: portal app registration > Certificates & secrets shows the secret expiry in the past, or the secret in use does not match any current key id. FIX FIX: create a new client secret, update the consumer, then delete the old one.

## The error

```text
AADSTS7000215: invalid client secret Cause: The service principal's secret expired (max 24 months) or the code uses the wrong secret/tenant. It worked for months then broke overnight = expiry. CONFIRM IT CONFIRM: portal app registration > Certificates & secrets shows the secret expiry in the past, o
```

## The fix

**TL;DR:** Symptom: AADSTS7000215: invalid client secret Cause: The service principal's secret expired (max 24 months) or the code uses the wrong secret/tenant. It worked for months then broke overnight = expiry. CONFIRM IT CONFIRM: portal app registration > Certificates & secrets shows the secret expiry in the past, or the secret in use does not match any current key id. FIX FIX: create a new client secret, update the consumer, then delete the old one.

## The fix

SYMPTOM
AADSTS7000215: invalid client secret

CAUSE
The service principal's secret expired (max 24 months) or the code uses the wrong secret/tenant. It worked for months then broke overnight = expiry.

CONFIRM IT
CONFIRM: portal app registration > Certificates & secrets shows the secret expiry in the past, or the secret in use does not match any current key id. Same error with a fresh login rules out transient AAD issues.

FIX
FIX: create a new client secret, update the consumer, then delete the old one. Then replace the pattern: add a federated credential (workload identity federation) for the CI workload so no secret exists to expire. Calendar a 30-day-before reminder for any secret you must keep.

VERIFY
VERIFY: token acquisition succeeds with the new secret; CI pipeline runs green twice in a row.

## When to use this

- You are seeing this exact error message; match the block above, not just part of it.
- The failing call matches the scenario in the title: Diagnose.
- You want the fastest verified fix before digging through logs.

## When not to use this

- Your error text differs from the block above; close cousins often have different causes.
- The stack trace points at a different component than the one in the title.
- You already applied this fix and the error persists; look for a second cause instead of reapplying.

## Compatibility

- Not pinned to a specific version; follows current Diagnose behavior.