how to fix signin issue. AADSTS501209: JWT signature is invalid [Reason - The key used is expired

Question

how to fix signin issue. AADSTS501209: JWT signature is invalid [Reason - The key used is expired

Brenda Knight 0

how to fix signin issue. AADSTS501209: JWT signature is invalid [Reason - The key used is expired.

I have an active Office 365 account which is current.

0 comments

1 answer

Your answer

Answer 1

Roebe Ta 1,545 Independent Advisor

Hello @Brenda Knight,

I hope you're doing well.

Based on my research, the error "AADSTS501209: JWT signature is invalid (key expired) " usually indicates that the JWT token is signed using an expired key (certificate or client secret) configured on the Microsoft Entra ID (Azure AD) app registration.

Once the signing key reaches its End date, Microsoft Entra ID will no longer accept tokens signed with it, resulting in the JWT signature validation failure.

To troubleshoot and resolve, you can try these steps:

1. Find your IT admin/Microsoft 365 admin to assist with this kind of issue.

If you haven’t yet reached out, here’s a helpful guide to locate your Microsoft 365 administrator: How do I find my Microsoft 365 admin? - Microsoft Support

2.Check credentials in the Azure Portal

Sign in to Microsoft Entra ID at https://entra.microsoft.com using an administrator account.
Navigate to Microsoft Entra ID > App registrations > All applications.
Paste the Application (client) ID into the search box, or locate it directly in the Application (client) ID column.

User's image

Click on the app's Display name.
Navigate to Certificates & secrets.
Check and verify whether any credential has an End date in the past or matching the date shown in the error:
- Certificates under Certificates
- Client secrets under Client secrets

User's image

3. Rotate the expired credential (required)

If using a certificate

Upload a new certificate
Ensure the new certificate has a valid future expiration date
Update the application/service to use the new certificate

User's image

If using a client secret

Create a new client secret

User's image

Copy the secret value immediately
Update the application configuration with the new secret

The expired credential cannot be reused once its end date has passed.

4. (Optional) Verify via Microsoft Graph

You can also inspect configured credentials using Microsoft Graph using the instructions:

Review:

keyCredentials > certificates
passwordCredentials > client secrets
Check the endDateTime values for expiration.

Note: Ensure you are using the correct Graph endpoint if the tenant is in a national cloud (GCC, Germany, China, etc.).

Once the credential is renewed and the application updated, authentication should succeed.

Please let me know if the issue persists. I'll be happy to assist further.

If the answer is helpful, please click "Yes, Accept Answer". If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Roebe Ta 1,545 Reputation points Independent Advisor

2026-10-06T14:53:34.4133333+00:00

Hello @Brenda Knight,

I hope you're having a nice day! I wanted to follow up to see if you need any additional help. I hope everything is going well on your part.

If you have any doubts, need clarification, or new questions have arisen, don't hesitate to get in touch. I am here to support you and happy to help.

I look forward to hearing from you!
Brenda Knight 0 Reputation points

2026-10-06T18:18:21.4066667+00:00

I was unable to use any of your suggestions because I can't use either of the email addresses that I have for Office365 to get in. I keep getting a similar error message about the key having expired. I have tried to access AZURE and ENTRA from Google Chrome and also Microsoft EDGE. Both give me a similar message about having trouble signing me in.

Here's a summary of what has happened:

I am able to open outlook on my laptop, I get the error message saying it's having trouble signing me in. I click to close that window and see that my email has not been loaded since the problem began on Oct 1st. BUT, I can create new contacts, calendar items and use the other outlook features. I can also use the word and excel apps from my office 365 account.

I believe the key that is being used when Outlook starts the process of downloading my email from an account that I have defined there, has become corrupted somehow. This feature of Outlook is the only part of the Outlook app that isn't working.

As some point in this adventure, I needed to open a word doc and got the same issue that I had with Outlook. I then tried an excel doc with the same result. At that point, I thought the entire Outlook app was not working. But suddenly on Monday morning, I tested a word doc again and it opened fine, allowed me to make changes and then save. I had the same experience with an excel doc, but still no change in Outlook being able to deliver emails since 10/1.

Another twist: this morning I got an email from Microsoft saying that my yearly subscription fee had been processed. On that email there's a link to manage accounts. I clicked there and am able to see my Microsoft account, details including that my subscription is now good until 10/6/2027

Any help you can provide will be greatly appreciated.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Brenda Knight 0 Reputation points

2026-10-06T19:55:24.5966667+00:00

I purchased the office 365 home subscription that could be used by up to 5 people. So am I the administrator?
Roebe Ta 1,545 Reputation points Independent Advisor

2026-10-08T08:48:27.4066667+00:00
Hi @Brenda Knight,

Thank you for the additional details. I'd like to ask a few questions to better understand whether this is a Microsoft account issue, an Outlook profile issue, or whether another Microsoft service is involved.

Can you sign in to Outlook on the web with the affected account?

Do you have any Microsoft business services associated with this account besides Microsoft 365 Home/Family? For example: Azure, Microsoft Entra ID (Azure AD), Power BI, Microsoft 365 Business, Dynamics 365

Do you have multiple accounts signed in to Office apps or Outlook?

For example, a personal Microsoft account and a work/school account.

In Word or Excel, go to File > Account and check whether more than one account is listed.

When you open Windows Settings > Accounts > Access work or school (or "Work or school account"), do you see any accounts listed there? If so, please let me know whether it shows as connected to an organization.

The error code AADSTS501209 is commonly associated with Microsoft Entra ID authentication, so it would be helpful to know if any business services are tied to the account.

I look forward to your update.
Brenda Knight 0 Reputation points

2026-10-08T20:03:24.14+00:00

My laptop is running windows 10. Could this be causing the issues with logging into my [Moderator note: Personally Identifiable Information removed]@bhhsgeorgia.com account which is a work email?
Roebe Ta 1,545 Reputation points Independent Advisor

2026-10-09T13:43:23.87+00:00
Thanks for your response, @Brenda Knight.

Based on the information you've provided, it appears that you may have multiple accounts signed in, which could potentially cause authentication conflicts.

Could you please confirm whether you have tried signing out of all Microsoft accounts and then signing back in using only the correct @bhhsgeorgia.com account?

Additionally, I'd appreciate it if you could check the following:

In Word or Excel, go to File > Account and verify whether both a personal Microsoft account and your work account are listed.

In Windows Settings > Accounts > Access work or school, check whether the @bhhsgeorgia.com account is connected.

Is the @bhhsgeorgia.com account managed by your organization, or do you manage it yourself? If it is a work account, does your organization have an IT administrator who manages Microsoft 365 or Microsoft Entra ID?

Also, Windows 10 itself would not normally cause an AADSTS501209: "JWT signature is invalid" error. This error is typically related to authentication credentials, account configuration, or identity management rather than the version of Windows being used.

Please let me know the answers to the questions above, and I'll be happy to continue troubleshooting with you.