error deleting old certificate on app registration

Question

I'm trying to delete an old about to expire cert for an app registration. I have imported the new cert but I get an error deleting the old one.

Failed to delete certificate. Error detail: No KeyCredential found with the configured TokenEncryptionKeyId. paramName: TokenEncryptionKeyId, paramValue: 329a30f4-cd0d-41c7-8983-dd187f2b4faf, objectType: Microsoft.Online.DirectoryServices.Application [50ae7Ckgfv7mWzhrzn7HLQ]

Answer 1

Hello @Ashley H,

This error message will trigger when you have TokenEncryptionKeyId present for your application. To fix this issue please deactivate the token encryption for your application and then try to delete the expired certificate from the application certs.

To deactivate token encryption in the Microsoft Entra admin center

1. In the Microsoft Entra admin center, browse to Identity > Applications > Enterprise applications > All applications, and then select the application that has SAML token encryption enabled.
2. On the application's page, select Token encryption, find the certificate, and then select the ... option to show the dropdown menu.
3. Select Deactivate token encryption.

To deactivate token encryption in the Microsoft Entra admin center

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".