Renewed Azure Multifactor Auth Client Certificate still showing expired in Enterprise Applications

Question

Yesterday, a certificate for VPN MFA expired.

As stated in the accepted answer in this question: https://learn.microsoft.com/en-us/answers/questions/195259/tenantid-certificate-for-vpn-mfa-expired-how-renew

And going through the documentation: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension-vpn#configure-certificates-for-use-with-the-nps-extension-by-using-a-powershell-script

We were successfull to generate a new certificate by executing the script.

Chechking if the script is correctly associated with the tenant:

Connect-MgGraph -Scopes 'Application.Read.All'
(Get-MgServicePrincipal -Filter "appid eq '981f26a1-7f43-403b-a875-f8b09b8cd720'" -Property "KeyCredentials").KeyCredentials | Format-List KeyId, DisplayName, StartDateTime, EndDateTime, @{Name = "Key"; Expression = {[System.Convert]::ToBase64String($_.Key)}}, @{Name = "Thumbprint"; Expression = {$Cert = New-object System.Security.Cryptography.X509Certificates.X509Certificate2; $Cert.Import([System.Text.Encoding]::UTF8.GetBytes([System.Convert]::ToBase64String($_.Key))); $Cert.Thumbprint}}

Was also successfull.

However, in our Azure Enterprise Applications, the certificate is still showing as expired:

My guess was, it just needed synchronizing but it didnt change. Did i miss a step or forgot something?

Thanks in advance for any help.

Answer 1

@Dvorak, David

I faced a similar issue, and the steps below resolved it for me:

1. Connect to your Microsoft Tenant via PowerShell using the command Connect-MsolService
2. Input the following command to retrieve the associated Service Principals: Get-MsolServicePrincipalCredential -AppPrincipalId "Application ID of the Azure-Multifactor Auth Client"
3. You'll receive a list containing all Service Principals and their corresponding credentials, including StartDate and EndDate. It's crucial to remove the expired ones. To do this, use the following code: $clientId = "Application ID of the Azure-Multifactor Auth Client" $keys = Get-MsolServicePrincipalCredential -AppPrincipalId $clientId -ReturnKeyValues $false $dtNow = [System.DateTime]::Now foreach($key in $keys) { if($key.EndDate -lt $dtNow) { Remove-MsolServicePrincipalCredential -KeyIds @($key.KeyId) -AppPrincipalId $clientId write-host $key.KeyId " - Expired - Deleted" } else { write-host $key.KeyId " - OK" } }
4. You may need to rerun the AzureMfaNpsExtnConfigSetup.ps1 script to register the certificate.

I hope it helps :)