Client secret has expired

Likely causes

• Credential rotation should be completed without exposing the secret value.
• The request is using a tenant, identity, application, resource, or policy context that does not match the intended operation.
• The error response is the symptom; the correlation/request ID and matching service log identify the controlling decision.

Recommended fix

1. Create a replacement credential using the approved rotation process.
2. Update the workload's secret store before removing the old credential.
3. Prefer certificates or managed identities where supported.

Verify

1. Repeat the smallest operation that produced the failure.
2. Confirm a fresh success in the authoritative service log or admin center, not only in the client UI.
3. Record the new UTC timestamp and correlation/request ID so the retry can be distinguished from cached or older failures.

Escalate when

• The failure persists after the documented prerequisites and a new authentication/session attempt.
• Multiple users, apps, devices, or networks show the same error, suggesting tenant policy or service scope.
• You can provide the exact UTC time, tenant, application/resource, correlation or request ID, and sanitized logs.