Renewing a Customer-Managed Client Secret

A client secret in Azure cannot be extended once created. Its expiration date is immutable. Renewing therefore means creating a new secret in Azure and replacing the stored value on the Delinea Platform.

To renew the client secret for a customer-managed registered app, perform the following steps.

  1. In the Azure portal, open the app registration for your customer-managed app.

  2. Under Manage, click Certificates & secrets.

  3. Click New client secret.

  4. Complete the Description field and set Expires to your required expiration date.

  5. Click Add.

  6. Copy the new secret's Value and its Expiration date before leaving the page. The value is not retrievable afterward.

  7. On the Delinea Platform, navigate to Settings > Registered apps.

  8. Open the Customer managed tab and select your app.

  9. Click Edit.

  10. Paste the new value into Client Secret Value.

  11. Click Save.

Troubleshooting

Entra ID users cannot log in and the client secret has already expired

Symptom. Entra ID users cannot sign in to the Delinea Platform. Platform admins cannot browse or search Entra ID users and groups.

Cause. The client secret reached its expiration date in Azure. The Delinea Platform does not rotate a customer-managed secret, so authentication stops on that date.

Resolution. Follow the renewal procedure above. An expired secret is renewed the same way as one that has not yet expired.

The Credential Expiration Date on the Platform does not match the Expires date in Azure

Symptom. The Credential Expiration Date shown under Settings > Registered apps differs from the Expires value on the client secret in Azure.

Cause. Either the secret was renewed in Azure without updating the Platform, or the date was entered incorrectly when the app was registered.

Resolution.

  1. In Azure, open the app registration and note the Expires date under Certificates & secrets.

  2. On the Delinea Platform, navigate to Settings > Registered apps and open the Customer managed tab.

  3. Select the app and click Edit.

  4. Set Credential Expiration Date to match the Azure value.

  5. Click Save.

Entra ID users still cannot log in after you renew the secret

Symptom. You updated the client secret on the Platform, but Entra ID users still cannot sign in.

Resolution. Check the following in order:

  1. Confirm you edited the app on the Customer managed tab. A Platform-managed app is a separate object and is not renewed by hand.

  2. Confirm you pasted the client secret Value, not the Secret ID. Azure displays both, and only the Value authenticates.

  3. Confirm no leading or trailing spaces were included in the pasted value.

  4. Confirm the registered app State is set to Enabled.

  5. Confirm the Log-in to Entra ID permission is still selected on the app.

  6. If the problem persists, run the federation debug console. See What if users can't log in after the integration is set up on the FAQ page.

Related Topics