# azure ad enterprise app saml token encryption mismatch error

## TL;DR
Compare certificate thumbprints on both sides: Entra ID's enterprise app SAML Token encryption page and the app's own decryption certificate store. Either import Entra's current certificate into the app or disable token encryption in Entra if the app does not support it. Re-run Entra's test single sign-on to confirm logins succeed.

```text
azure ad enterprise app saml token encryption mismatch error
```

## Use this when

- SAML login fails with a token decryption or encryption error after a certificate rollover
- Entra ID shows token encryption enabled but the app cannot read the assertion
- Logins broke on both sides right after either side rotated certificates

## Not for this skill when

- SAML signature validation failures (different problem, check signing certs)
- Apps that never used token encryption (nothing to mismatch)
- Failures before the SAML response is even issued (check the request side)

## Steps

### Step 1: Capture the exact error

Get the decryption failure from the application logs, including any certificate thumbprint it mentions. Expected: you know which certificate the app tried and failed to use.

### Step 2: Inspect Entra's token encryption cert

In Entra ID go to Enterprise apps, the app, Single sign-on, then Token encryption, and note the active certificate and thumbprint. Expected: you have Entra's side of the comparison.

### Step 3: Compare thumbprints

Compare Entra's thumbprint with the decryption certificate configured in the application. Expected: you can state whether they match or diverged, and when.

### Step 4: Realign the certificates

Import Entra's current token encryption certificate into the app, or turn off token encryption in Entra if the app does not support encrypted assertions. Expected: both sides agree on one certificate or on no encryption.

### Step 5: Test single sign-on

Use Entra's Test single sign-on feature and complete a real login. Expected: the assertion decrypts and the user lands in the app.

### Step 6: Plan the next rollover

Record both expiry dates and who owns each side so the next rotation is coordinated. Expected: a dated reminder exists before either certificate expires.

## Tool compatibility

Microsoft Entra ID enterprise apps (SAML); SAML 2.0 service providers with optional assertion encryption; Entra test single sign-on tool.

## Variant phrasings

### Variant 1

saml token encryption certificate mismatch azure ad

### Variant 2

entra id saml assertion decryption failed certificate

### Variant 3

unable to decrypt saml token entra enterprise app

## Why it happens

Token encryption is optional in SAML: the identity provider encrypts the assertion with a certificate whose private key only the service provider holds. It works until either side rotates its certificate without telling the other, at which point the app receives an assertion it cannot decrypt and fails every login. The confusion is compounded because SAML has two certificates doing two jobs: the signing certificate that proves the assertion is genuine, and the encryption certificate that keeps it confidential. Teams chase the signing certificate because it is more familiar, while the failure is on the encryption side, which many apps never configured deliberately in the first place.

## Edge cases / pitfalls

- Some apps silently ignore the encrypted assertion instead of erroring; check for missing attributes, not just login failures.
- Metadata-driven configuration can reintroduce the old certificate on the next metadata refresh; pin the change.
- Disabling encryption is legitimate when transport is already TLS, but record the decision for security review.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TJSOlpsU3uuVigwsrIBoiw