AADSTS7000215 — "Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID." The confidential client authenticated with a secret that does not match any current secret on the app registration. The error text itself calls out the most common mistake: the portal shows both a secret value (usable, and only visible at creation time) and a secret ID (a GUID, useless for authentication).
AADSTS7000215
Invalid client secret provided
What it means
Common causes
The client secret expired — secrets have a maximum lifetime set at creation and expire silently.
The secret ID (GUID) was configured instead of the secret value.
The secret value was mangled in transit: not URL-encoded in raw HTTP token requests (secrets often contain special characters), or truncated in a config store.
The secret belongs to a different app registration or environment.
How to fix it
Check expiry: Entra admin center > App registrations > (app) > Certificates & secrets — expired secrets are listed. Create a new secret and copy the Value column immediately (it is shown only once).
Update the deployed configuration/key vault with the new value and restart consumers.
In raw token requests, URL-encode the
client_secretform value.Prefer certificates or managed identities/workload identity federation over secrets — no expiry surprises and no secret sprawl.
Frequently asked
I copied the secret from the portal — why is it invalid?
Check whether you copied the secret ID (a GUID) instead of the secret Value — only the Value works, and it is visible just once at creation. If the Value column shows only asterisks or a partial string, create a new secret and copy it immediately.