Expiring AzureAD Client secret with implicit and hybrid flow

Saravanakumar Balachandran 25 Reputation points
2023-09-20T21:21:55.56+00:00

Our AzureAD Client secret is going to expire soon and we already created a new client secret but have not deleted the expiring one yet. It is used to authenticate our .Net core Web application.

We store Clientid, TenantId, domain etc. in appsettings.json and authenticate it using OpenIdConnectDefaults.AuthenticationScheme with Microsoft Identity platform (i.e. using .AddMicrosoftIdentityWebApp AzureAD configuration binding). We currently do not hardcode or specify the ClientSecret in our application or using any keyvault storage.

This is the screenshot of our Azure AD authentication set up which uses ID tokens (Implicit and hybrid flows option). It also does not allow public client flow.

User's image

If we delete the expiring secret now or let it expire next week, Do we need to make any change in the application or ID tokens (implicit and hybrid flow) option even require a client secret? Kindly appreciate your response.

Azure Application Gateway
Azure Application Gateway

An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
Developer technologies | ASP.NET Core | Other
0 comments No comments

1 answer

Sort by: Most helpful
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    1 deleted comment

    Comments have been turned off. Learn more

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.