Faced an error related to azure application secret keys, but not able to get appropriate role to solve the issue

Question

Faced an error related to azure application secret keys, but not able to get appropriate role to solve the issue

Anonymous

Hello! Recently, we needed to grant one of our Azure users access to Azure Active Directory -> App Registrations in order to update secret keys for an application.

User role Contributor.

Please guide me, what role should be granted to the user to be able to update secret keys for applications?

Our Azure Subscription ID: 4ba309c6-388c-49a5-ae09-4bcde0cfb4be
The error log is attached below.

[error]Error: Failed to get resource ID for resource type 'Microsoft.Web/Sites' and resource name 'tumlinsonelectric-production'. Error: Could not fetch access token for Azure. Status code: invalid_client, status message: Error(s): 7000222 - Timestamp: 2025-06-24 07:49:20Z - Description: AADSTS7000222: The provided client secret keys for app '***' are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds. Trace ID: 9f12c65f-3530-4e05-8bd1-8dc1948cb000 Correlation ID: 8555d9f6-fc7b-4381-a640-01560f7bf34c Timestamp: 2025-06-24 07:49:20Z - Correlation ID: 8555d9f6-fc7b-4381-a640-01560f7bf34c - Trace ID: 9f12c65f-3530-4e05-8bd1-8dc1948cb000

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hi Aleksandr Zhadetsky

To update secret keys for an Azure App Registration, the user must have appropriate directory-level permissions in Microsoft Entra ID, not just a Contributor role at the subscription or resource group level. While the Contributor role allows management of Azure resources such as virtual machines and web apps, it does not grant access to manage app registrations or their secrets, as these are directory-level objects.

To perform actions like updating client secrets, the user must be assigned one of the following Entra roles: Application Administrator, Cloud Application Administrator, or Privileged Role Administrator.

You can assign these roles by navigating to Microsoft Entra ID > Roles and administrators, selecting the appropriate role, and adding the user under Add assignment.

For your reference: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/manage-roles-portal?tabs=admin-center

The error you're seeing AADSTS7000222: The provided client secret keys for app '[App ID]' are expired indicates that the current secret has expired and must be renewed by a user with the required permissions. For detailed steps on updating credentials, refer to the official documentation: Add credentials to a Microsoft Entra application.

Hope this helps. Do let us know if you any further queries.

Please remember to "Accept Answer" if answer helped you. This will help us as well as others in the community who might be researching similar questions.