Azure Pipelines: "AADSTS7000215: Invalid client secret provided" and "AADSTS7000222"
An Azure Resource Manager service connection of the secret kind signs in to Microsoft Entra ID with an app registration and one of its client secrets. When Entra rejects that secret, every task that uses the connection fails. AADSTS7000222 means the secret has expired; AADSTS7000215 means the secret sent is not a valid one for that app, most often because the secret's ID was saved instead of its value, or the secret was deleted in Entra.
When the failing run is a pull request's build validation, the pull request waits on it: Azure DevOps Pull Requests, a plugin for JetBrains IDEs, lists the pull request's branch policies with their state in IntelliJ IDEA, Rider or PyCharm, and with Pro runs a failed build policy again once the connection is fixed. Get it on JetBrains Marketplace
What it looks like
AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app '...'.AADSTS7000222: The provided client secret keys for app '...' are expired.- From the deploy tasks, such as Azure App Service deploy:
Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired. - From the Azure CLI task:
Secret expired, update service connection at ..., with a link about converting to a connection without a secret. - When you edit and save the connection:
Failed to obtain the Json Web Token(JWT) using service principal client ID. Microsoft's troubleshooting page says this comes from an expired secret or another problem on the Entra side.
First, look at the connection
- Open Project settings, Service connections, and the connection the task names. Its details say whether Azure DevOps created the app registration (automatic) or someone entered an existing one (manual), and whether it uses a secret or workload identity federation.
- Check that the connection is enabled. Microsoft's page notes that an administrator can disable it and that Azure Pipelines may disable one after 100 days without use.
- Renewing changes the secret of the app registration, so the person doing it needs to be an administrator of the service connection and to have the rights on the app in Entra and on the subscription.
A connection Azure DevOps created: Rotate secret
- Microsoft's page says the secrets that Azure DevOps creates expire and need renewing. In the connection, select
Rotate secret; the secret is renewed for three more months. You can do it before it expires. - If there is no Rotate secret, select Edit and then Save, which renews it too.
- Three months later it expires again, so put a reminder in a calendar, or move the connection to workload identity federation (below).
A connection you created: a new secret value
- In the Entra admin center or the Azure portal, open App registrations, the app of the connection (its client ID is in the connection), Certificates & secrets, and add a new client secret.
- Copy the Value column, not the Secret ID column. The value is shown only right after you create the secret; saving the ID is what AADSTS7000215 warns about.
- Edit the service connection, paste the value as the service principal key, verify and save. Delete the old secret in Entra once the pipelines run with the new one.
For good: workload identity federation
- A connection with workload identity federation has no secret: Azure DevOps gets a short-lived token for each run, so neither error can happen there. Microsoft recommends it to avoid renewing secrets.
- Microsoft's pages say to convert an existing connection rather than create a replacement, so the pipelines that refer to it keep working. A manual app registration needs a federated credential added to it in Entra, which Microsoft's page on workload identity service connections walks through.
- On federation, the Azure CLI task can keep a long script signed in with
keepAzSessionActive; see Please run 'az login' to setup account.
Azure DevOps pull requests in IntelliJ IDEA, Rider and PyCharm
Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later and Android Studio, reads the organization, project and repository from your git remote and lists the pull requests that wait for your review in an IDE tool window, on Azure DevOps Services and on Azure DevOps Server. It shows the branch policies of a pull request with their state, so a required build that has not passed is next to its pull request, and with Pro you run a failed or expired build policy again from there. The review inbox is free; voting, commenting, completing and creating are Pro, with a 30-day trial.
Get it on JetBrains Marketplace
Azure, Azure DevOps, Azure Pipelines and Microsoft Entra are trademarks of Microsoft Corporation; IntelliJ IDEA, Rider and PyCharm are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft or JetBrains.
More: Please run 'az login' to setup account · There was a resource authorization issue · This pipeline needs permission to access a resource · 日本語