> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://support.contracthero.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Microsoft Entra SSO fails: Client secret expired — how to fix it


# **Microsoft Entra SSO fails: Client secret expired — how to fix it**


> **Summary:** If users can’t sign in via **“Sign in with Microsoft” (SSO)**, the **client secret** of your Microsoft Entra app registration likely expired. Create a **new client secret** in Entra and update your ContractHero SSO configuration. With IT support this takes **~15–20 minutes**.
> **Immediate workaround:** Users can continue to sign in at **app.contracthero.com/login** with **email + password** (“**Forgot password**” if needed).



## Symptoms


* SSO pop-up opens briefly, then closes and shows an error
* Direct email + password sign-in **still works** (sometimes not for a few users)
* Issue appeared “suddenly”, typically **~12 months** after initial SSO setup



## Root cause


* The **client secret** in the **Microsoft Entra ID** app registration has **expired**, invalidating the trust between Entra and ContractHero.



## Prerequisites


* Access to **Microsoft Entra Admin Center** (e.g., *Application Administrator* or *Global Administrator*)
* Name of the **app registration** used for ContractHero (e.g., “ContractHero SSO”)
* Optional for verification: **Tenant ID** and **Application (Client) ID**




## **Step-by-step**


1. **Locate the app**
Entra Admin Center → **App registrations** → open the ContractHero app.
2. **Create a new client secret**
**Certificates & secrets** → **New client secret**
    * **Description:** ContractHero {YYYY-MM}
    * **Expiration:** per your security policy (commonly 24 months)
3. **Secure the Secret Value**
**Important:** Copy the **Secret Value** immediately (not the Secret ID) — it won’t be shown again.
4. **Provide the secret to ContractHero securely**
Use a **one-time secure link** or a **short live call**.
Helpful for cross-check: **Tenant ID** and **Application (Client) ID**.
ContractHero will update your **SSO configuration**.
5. **Functional test**
In a private/incognito window click **“Sign in with Microsoft.”**
Optionally review **Sign-in logs** in Entra.
6. **Cleanup**
Remove the **old secret** in Entra.




## **Best practices**


* Set **alerts/reminders** for **expiring application credentials** (e.g., 30 days before expiration)
* Choose **secret lifetime** per policy and plan **regular rotation**
* **Document** ownership/access for the app registration and secrets




## **Troubleshooting (FAQ)**


**SSO still failing:**

* Validate the **Secret Value** (no spaces/line breaks)
* Ensure it was applied to the **correct app registration**
* Re-check **redirect URIs** and **scopes** from initial setup
* Inspect **Enterprise applications → Sign-in logs** in Entra


**Some users can’t sign in even with password:**

* Use **“Forgot password”** and verify email login
* Check roles/licensing within ContractHero (does the user have access?)