have you considered implementing OAuth 2.0 authorization code flow it will allow users to authenticate without the need for client secrets.
Azure Active Directory (AAD) authentication or aad B2C authentication within a PHP application
Arun Pradhan (MINDTREE LIMITED)
0
Reputation points Microsoft External Staff
My PHP application, which is built on WordPress, currently utilizes WordPress AAD authentication with client ID and client secrets. However, I am looking to discontinue the use of client secrets. Presently, I am using the functionality available on GitHub.
https://github.com/psignoret/aad-sso-wordpress
I'm exploring alternative solutions that work for PHP without requiring client secrets. I also consulted the Kiota documentation, but it also relies on client secrets.