AADSTS7000215: invalid client secret
The app tried to authenticate to Entra ID with a client secret that isn't valid, so it can't get a token.
From Microsoft's documentation, checked 9 Nov 2026.
AADSTS7000215: Invalid client secret is provided.Also searched as: invalid client secret
What it means
Microsoft's reference calls this a developer error: the app is trying to sign in without the necessary or correct authentication parameters. Client secrets are managed under the app registration's Certificates & secrets, and Microsoft recommends a certificate or federated credential instead of a secret in production. An expired secret returns AADSTS7000222.
Common causes
- The app sends a client secret that doesn't match one on the app registration.
- The app is missing the authentication parameters it needs.
How to fix it
List the app's secrets
Read the app registration's password credentials with Microsoft Graph (Application.Read.All) to see which secrets exist and when they expire.
GET https://graph.microsoft.com/v1.0/applications(appId='<app-id>')?$select=displayName,passwordCredentials
Check the app's configuration
Compare the secret the app is configured with against the app registration's Certificates & secrets. Add a new credential if the right one isn't available.
Prefer a certificate
For production, Microsoft recommends a certificate or federated identity credential rather than a client secret.
How to confirm it's fixed
- Token requests from the app succeed with the corrected credential.
Related notes
AADSTS7000222 is the separate code for expired client secret keys.
Related engineering templates
Follow Microsoft Entra ID failures and fixes
A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.