Error text: `AADSTS7000215: Invalid client secret provided.`

Triage:

1. **Expired.** App registrations show secret expiry in the portal (Certificates & secrets). Secrets max out at 24 months. If it worked for months then broke overnight, this is it.
2. **Wrong secret.** Multiple secrets on one app registration; the code uses an old one. Compare the secret's key id/hint, never the value.
3. **Wrong tenant.** A secret from tenant A used against tenant B gives the same error shape. Check the authority URL.
4. **Create a new secret**, update the consumer, then DELETE the old one. Do not delete first.
5. **Then kill the pattern.** Add a federated credential (workload identity federation) for the CI workload so there is no secret at all: Entra > App registrations > Certificates & secrets > Federated credentials. GitHub Actions, Azure DevOps, and Terraform Cloud all support OIDC federation to Entra now.

Calendar rule: if you must keep secrets, set the expiry reminder for 30 days before, not the day of. The 2am page is the tax on skipping step 5.