Microsoft Entra SSO fails: Client secret expired — how to fix it

Summary: If users can’t sign in via “Sign in with Microsoft” (SSO), the client secret of your Microsoft Entra app registration likely expired. Create a new client secret in Entra and update your ContractHero SSO configuration. With IT support this takes ~15–20 minutes.
Immediate workaround: Users can continue to sign in at app.contracthero.com/login with email + password (“Forgot password” if needed).

Symptoms

• SSO pop-up opens briefly, then closes and shows an error
• Direct email + password sign-in still works (sometimes not for a few users)
• Issue appeared “suddenly”, typically ~12 months after initial SSO setup

Root cause

• The client secret in the Microsoft Entra ID app registration has expired, invalidating the trust between Entra and ContractHero.

Prerequisites

• Access to Microsoft Entra Admin Center (e.g., Application Administrator or Global Administrator)
• Name of the app registration used for ContractHero (e.g., “ContractHero SSO”)
• Optional for verification: Tenant ID and Application (Client) ID

Step-by-step

1. Locate the app

Entra Admin Center → App registrations → open the ContractHero app.

2. Create a new client secret

Certificates & secrets → New client secret

• Description: ContractHero {YYYY-MM}
• Expiration: per your security policy (commonly 24 months)

3. Secure the Secret Value

Important: Copy the Secret Value immediately (not the Secret ID) — it won’t be shown again.

4. Provide the secret to ContractHero securely

Use a one-time secure link or a short live call.
Helpful for cross-check: Tenant ID and Application (Client) ID.
ContractHero will update your SSO configuration.

5. Functional test

In a private/incognito window click “Sign in with Microsoft.”
Optionally review Sign-in logs in Entra.

6. Cleanup

Remove the old secret in Entra.

Best practices

• Set alerts/reminders for expiring application credentials (e.g., 30 days before expiration)
• Choose secret lifetime per policy and plan regular rotation
• Document ownership/access for the app registration and secrets

Troubleshooting (FAQ)

SSO still failing:

• Validate the Secret Value (no spaces/line breaks)
• Ensure it was applied to the correct app registration
• Re-check redirect URIs and scopes from initial setup
• Inspect Enterprise applications → Sign-in logs in Entra

Some users can’t sign in even with password:

• Use “Forgot password” and verify email login
• Check roles/licensing within ContractHero (does the user have access?)

Updated on: 11/05/2025