Skip to main content
wadah
Staff
wadah
Staff
June 16, 2026

Troubleshooting Tip: Failed to get Microsoft Entra Groups due to client secret expiration

  • June 16, 2026
  • 0 replies
  • 56 views

Description

This article describes how to troubleshoot the issue where FortiSASE fails to get Microsoft Entra ID Groups due to client secret expiration.

Scope

FortiSASE.

Solution

By connecting a Microsoft Entra ID domain to FortiSASE, the synchronized Entra groups can be used for purposes such as Endpoint Group assignment.

In this scenario, when Endpoint Groups are not assigned as intended according to the Entra groups, it is necessary to verify whether the domain sync with Entra ID is working correctly.

Issue:

For FortiSASE to synchronize information from Microsoft Entra ID, a valid client secret must exist on Entra ID, and the same client secret must be applied on the FortiSASE side.

When the client secret expires on the Entra ID side, the group synchronization silently stops working, and changes made on Entra ID are no longer reflected on FortiSASE.

The following symptoms may indicate that the client's secret has expired:

  • The number of synced Endpoints and Users does not increase or decrease as expected.

  • Entra groups are specified in the Endpoint Group assignment, but the expected Endpoint Group is not assigned.


How to verify on FortiSASE:

  1. Collect a HAR file in the browser when selecting the 'Sync' button, and check for an error indicating that the client secret has expired.

To collect a HAR file on a Windows device, press the F12 key in a major web browser such as Google Chrome or Microsoft Edge.

Name: domain-stats -> Response:

"lastError": "error getting Azure domain info for tenant id XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX: retrieving access token: acquireTokenByCredential() error: FromClientSecret(): http call(https://login.microsoftonline.com/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/oauth2/v2.0/",

2986e20b.png


  1. Go to Access & authentication -> AUTHENTICATION SOURCES -> Domains.

Select the target domain, select 'Edit', then select 'Update' without changing anything.
If the client secret has expired, the error 'Failed to connect to domain server.' is returned.

f7e7f589.pngdf87b685.png


How to verify on the Azure Portal:

Go to Microsoft Entra ID -> Monitoring -> Sign-in logs -> Service principal sign-ins.

Select a log entry with the Status 'Failure'. If the client secret has expired, the following error appears in the 'Failure reason' field:

The provided client secret keys for app '{identifier}' are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds.


ab19462b.png


Note:
The client secret is critical for FortiSASE to retrieve the latest information from Microsoft Entra ID.

Therefore, be sure to keep track of its expiration date and renew the client secret before it expires.


Related article:

Technical Tip: FortiSASE Failed to get Microsoft Entra Groups

Terms & ConditionsAccessibility statement