> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cloud/knowledge-base/troubleshooting-articles/invalid-client-id-or-secret-with-microsoft-sso.md).

# Invalid client ID or secret with Microsoft SSO

Fix the invalid client ID or secret error in Devolutions Cloud Microsoft SSO by renewing the expired Azure Entra ID application client secret.

To following message may appear when trying to sign into a Devolutions Cloud using Microsoft Single Sign-On (SSO): "The client ID or secret supplied by your organization is invalid, please contact an administrator of your organization."

### Solution

This most likely means that the Microsoft Azure Portal client secret is expired. The solution is to create a new secret and change it in the Devolutions Cloud' SSO configuration.

#### Verify the client secret expiration date

1. In a new web browser page, sign into [Microsoft Azure Portal](https://azure.microsoft.com/).
2. Select ***Microsoft Entra ID*** in the ***Azure services*** section. If it is not immediately visible, click on ***More services***.
3. Click on ***App registrations*** in the left menu.
4. In the list, click on the application that was used to configure SSO in the problematic Devolutions Cloud instance.
5. Click on ***Certificates & secrets*** in the left menu.
6. Locate the secret that is currently used for Devolutions Cloud' SSO configuration and see if it is expired in the ***Expires*** column.

If it is indeed expired, this is most likely the cause of the connection issue. The next step is to create a new client secret and change it in Devolutions Cloud' SSO configuration.

{% hint style="info" %}
If the client secret is not expired, the issue may come from the client ID. Verify that it matches the one in Devolutions Cloud' SSO configuration then try logging in again.
{% endhint %}

#### Create a new client secret

1. Click on ***New client secret***.
2. In the ***Add a client secret*** window, enter a ***Description*** (for example, the name of the Enterprise app) and select an expiration date for this client secret, as per your best internal security practices.
3. Click ***Add***.
4. Copy the ***Value*** of this new client secret by clicking on the ***Copy to clipboard*** icon next to it.

The expired client secret can be deleted without any issue since it is expired and cannot be used anymore.

#### Update the client secret in Devolutions Cloud

1. Log in to Devolutions Cloud with your Devolutions Account.

If the ***Force SSO on all users*** option is enabled, logging in will not be possible with your Devolutions Account. In this case, [contact our customer support team](mailto:service@devolutions.net) to request the disabling of this option.

2. Once logged in, go to ***Administration – Authentication – Single Sign-On (SSO)***, then select your Microsoft SSO configuration.
3. The ***Client secret key*** field is greyed out and cannot be edited directly. Click the ***X*** button in the field to clear the existing key.
4. Click the ***Paste*** button (clipboard icon) next to the field to paste the new client secret. The field can only be populated this way. It cannot be typed in directly.
5. Click ***Test Configuration***.
6. If the connection is successful, your account will connect with Entra ID and a summary of the configuration will be displayed.
7. In the ***Summary*** of the configuration, click ***Save***.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cloud/knowledge-base/troubleshooting-articles/invalid-client-id-or-secret-with-microsoft-sso.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.