/errors/entra-id/aadsts7000215-invalid-client-secret-provided
AADSTS7000215: Invalid client secret provided
- tool
- Microsoft Entra ID
- versions
- Microsoft Entra ID
- os
- any
AADSTS7000215: Invalid client secret provided. means the app authenticated with a client secret that Entra ID does not accept for that application. Microsoft's reference describes it as an invalid client secret, a developer error where the app signs in without the correct authentication parameters. The most common cause is sending the client secret ID instead of its value. Create a new secret, copy its Value (it is shown only once), and update the configuration.
Value versus Secret ID
On App registrations > your app > Certificates & secrets, each client secret has:
| Column | Looks like | Use it as client_secret? |
|---|---|---|
| Description | Free text | No |
| Expires | A date | No |
| Value | A random string, shown in full only right after creation | Yes |
| Secret ID | A GUID | No: this is the cause of most AADSTS7000215 errors |
If the value was not saved when the secret was created, it cannot be shown again: add a new secret and delete the old one.
Related secret errors
| Code | Meaning |
|---|---|
| AADSTS7000215 | The secret is not valid for this app (wrong value, Secret ID used, other app) |
| AADSTS7000222 | The secret has expired; create new keys or use a certificate |
| AADSTS700016 | The client ID itself was not found in the tenant |
Prefer certificates for unattended scripts
Client secrets are easy to copy wrongly and travel as plain strings. For PowerShell automation, a certificate credential keeps the private key in the certificate store instead:
Connect-MgGraph -ClientId 'APP_ID' -TenantId 'TENANT_ID' -CertificateThumbprint 'THUMBPRINT'When a secret is required, pass it as a PSCredential whose user name is the client ID:
$cred = Get-Credential -UserName 'APP_ID' -Message 'Client secret value'
Connect-MgGraph -TenantId 'TENANT_ID' -ClientSecretCredential $cred