Azure App Secret Expiring: Applications Configurator Prod

A client secret cannot be renewed in place; create a replacement now, update and validate every consumer, and delete the old secret only after the new one works.

Rotate the secret safely

1. Sign in to the correct tenant and open: Microsoft Entra ID → App registrations → Applications Configurator Prod → Certificates & secrets → Client secrets.
2. Select New client secret.
3. Enter a distinct description, such as pis_client_secret_local-2026, choose an expiration allowed by your organization, and select Add.
4. Immediately copy the new secret’s Value, not its Secret ID. The value cannot be retrieved after leaving the page.^1^
5. Store the value in the application’s approved secret store, such as its deployment secret store or Key Vault. Do not place it in source control, pipeline YAML, logs, or a work item.
6. Update every application, deployment environment, or pipeline that currently consumes pis_client_secret_local.
7. Restart or redeploy the consumer if required, then run a real authentication or deployment test.
8. After successful validation, return to Certificates & secrets and delete the old secret. Adding the replacement does not invalidate the existing secret, so both can overlap during testing.^2^

Do not delete the current secret first; its remaining validity provides the rollback window.

If Azure DevOps created and manages this secret

If the app registration backs an Azure Resource Manager service connection and Azure DevOps created its secret, rotate it from Azure DevOps instead of manually replacing its value:

1. Open the Azure DevOps project.
2. Go to Project settings → Service connections.
3. Open the Azure Resource Manager connection associated with this application.
4. Select Rotate secret.
5. If Rotate secret is unavailable, select Edit → Save.
6. Select Verify, then run a pipeline that uses the connection.

Azure DevOps updates the associated app-registration credential through this operation.^3^

Use this path only when the service connection owns the secret. If the same secret is also copied into another application or custom pipeline variable, those copies must be updated separately.

Permissions

If New client secret, Rotate secret, or saving the service connection is denied:

• Managing app-registration secrets requires Microsoft Entra directory permissions; Azure subscription Contributor alone is insufficient. An app owner or an appropriate role such as Application Administrator or Cloud Application Administrator can perform the rotation.^4^
• Azure DevOps rotation also requires suitable permissions for the service connection, subscription, and associated Microsoft Entra application.^3^

Avoid future secret expiry

If this is an Azure Resource Manager service connection, convert it to workload identity federation where your environment and pipeline tasks support it. Microsoft recommends this authentication method because it eliminates client-secret storage and rotation.^5^

The conversion is available from the existing service connection’s configuration. Validate the converted connection with a pipeline run before removing any remaining secret credential.

References

1. Register an application in Microsoft Entra ID
2. Reduce expiry dates for existing Client Secrets for App Registrations & Service Principals? - Microsoft Q&A
3. Troubleshoot Azure Resource Manager service connections
4. Faced an error related to azure application secret keys, but not able to get appropriate role to solve the issue - Microsoft Q&A
5. Connect to Azure with an Azure Resource Manager service connection