Invalid issuer oR signature error in SPO Provider-Hosted AddIns - After renewal of the ClientID

Question

Hi Team,

We have SharePoint Online (SPO) Provider-Hosted Add-ins that utilize Remote Event Receivers (RERs). The client secret associated with these add-ins expired in mid-April. Yesterday, we renewed the same Client ID by generating a new client secret, extending its validity for another year.

However, after updating the application with the newly generated client secret, we encountered an installation error stating:

"Invalid issuer or signature."

Any insights on resolving this issue would be helpful.

Answer 1

The error is likely due to the retirement of Azure Access Control Services (ACS), which previously handled authentication for add-ins. Microsoft has announced that ACS will be retired in April 2026, leading to the discontinuation of features like Remote Event Receivers that depend on it.

It's recommended that shift your add-in's authentication mechanism from ACS to Azure AD. This involves registering your add-in as an Azure AD application and configuring it to use OAuth tokens for authentication.​

Reference:

https://techcommunity.microsoft.com/blog/spblog/remote-event-receivers-retirement-update-in-sharepoint-online/4068938

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.