highFoundationSymptom-first#service-principal#secret#expired#authentication#credentials

Service principal secret expired — authentication failures

az login --service-principal fails with AADSTS7000222 or invalid client secret

Likely source:securityconfiguration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • az login --service-principal fails with AADSTS7000222 or invalid client secret
  • CD/CD pipelines fail authentication after working previously
  • Azure service outages reported from automation scripts with no code change

Set a reminder (or automated alert) at 30 days before SP secret expiry. Store the secret in Key Vault and rotate via a scheduled runbook to avoid manual misses.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Service principal details

    az ad sp show --id <APP-ID> --query "{appId:appId,displayName:displayName}" -o json

  • Client secret expiration

    az ad sp credential list --id <APP-ID> --query "[].{keyId:keyId,endDate:endDate}" -o table

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • az ad sp credential list shows endDate in the past
  • az login --service-principal returns AADSTS7000222

Confirm before fixing

az ad sp credential list --id <APP-ID> --query "[?endDate < now()]" -o table
READ

Find expired credentials

Fix

az ad sp credential reset --id <APP-ID> --years 2
CHANGE

Reset the service principal credential with a new expiry

Expected: A new password is output — store it in the key vault

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
az ad sp credential list --id <APP-ID> --query "[].{keyId:keyId,endDate:endDate}" -o table
READ

Check credential expirations

2
az ad sp credential reset --id <APP-ID> --years 2
CHANGE

Reset and generate a new secret

3
az keyvault secret set --vault-name <KV-NAME> --name <SP-SECRET-NAME> --value <NEW-CLIENT-SECRET>
CHANGE

Store the new secret in Key Vault

4
az login --service-principal --username <APP-ID> --password <NEW-CLIENT-SECRET> --tenant <TENANT-ID>
READ

Verify the new secret authenticates

Expected: The user or service principal is signed in.

Prevention

  • Store service principal secrets in Key Vault and reference them in pipelines.
  • Rotate client secrets on a 12-month schedule with an automated runbook.
  • Set up Azure Monitor alerts on AADSTS7000222 login failures.
  • Use workload identity federation to eliminate service principal secret rotation.

Related runbooks

Same stack, same failure family — worth a skim.

Managed Identity not enabled on Azure resource — authentication failureshigh

Application throws ClientAuthenticationError: ManagedIdentityCredential authentication failed

AzureIntermediate3 causes
Open runbook
Key Vault RBAC — insufficient privileges for secret and certificate accesshigh

az keyvault secret show returns Forbidden: insufficient permissions

AzureIntermediate2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.