Enterprise Application Certificate Expired

Question

Enterprise Application Certificate Expired

IBeTheBot 0

Hi All,

I have an enterprise application where there certificate has expired and looking for the solution to renew it.

When I go to Token Encryption I get an error saying the following:

"Token encryption is not available for this application. (App Name) is owned by another organization.

To change token encryption settings for this application, please contact the application owner."

Thoughts?

Dillon Silzer 57,826 Reputation points Volunteer Moderator

2023-07-15T03:07:38.3866667+00:00

Are any other apps having similar errors? May I ask what Enterprise Application this is?

1 answer

Your answer

Dillon Silzer 57,826 Reputation points Volunteer Moderator

2023-07-15T03:07:38.3866667+00:00

Are any other apps having similar errors? May I ask what Enterprise Application this is?

Answer 1

Sandeep G-MSFT 20,906 Microsoft Employee Moderator

@IBeTheBot

Looks like the application for which you are trying to renew the encryption certificate is a multi-tenant application.

It means this application in registered in another tenant and your only have a service principal which is created in your tenant for this application.

For, multi-tenant applications, the certificates has to be update on the tenant where it is initially registered.

To know in which tenant the actual application registered for corresponding service principal, you can follow below steps,

Open Windows PowerShell as Administrator.
Run command "Connect-AzureAD"
Enter the global admin credentials of your tenant.
Now run command " Get-AzureADServicePrincipal -ObjectId "<Object ID of service principal (app under enterprise application)>" | fl"
In the output you can look for AppOwnerTenantId parameter.

The tenant ID that you see in above result is the tenant where your application is registered.

Token encryption key has to be updated in that tenant directory.

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

IBeTheBot 0 Reputation points

2023-07-18T17:34:19.3433333+00:00

Still not 100% sure why I can't extend the certificate, but I was able to follow the following and create a new SA.

https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs
Sandeep G-MSFT 20,906 Reputation points Microsoft Employee Moderator

2023-07-21T09:34:52.79+00:00
@IBeTheBot

When it comes to developing apps, developers can choose to configure their app to be either single-tenant or multi-tenant during app registration in the Azure portal.

Single-tenant apps are only available in the tenant they were registered in, also known as their home tenant.

Multi-tenant apps are available to users in both their home tenant and other tenants.

The issue that you are facing is for the multi-tenant application. In this the application is registered in some other tenant and the instance of service principal will be present in your tenant.

Certificates will be handled in the tenant where your application is registered.

You can go thourgh below article to know more about the multi-tenant application Architecture.

https://learn.microsoft.com/en-us/azure/architecture/guide/multitenant/overview

Let me know if you have any questions

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Sandeep G-MSFT 20,906 Reputation points Microsoft Employee Moderator

2023-07-24T04:37:34.5166667+00:00

@IBeTheBot

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread.

Share via

Enterprise Application Certificate Expired

1 answer

Your answer