jwt signiture is out of date

The registered certificate used to sign the JWT expired on August 10, 2026 at 16:15:06, so replace that application credential and configure the application to sign assertions with the new certificate.

Replace the expired certificate

1. Sign in to the Microsoft Entra admin center with an account authorized to update the app registration.
2. Go to Entra ID → App registrations.
3. Search by the Application (client) ID shown in the error. Use the real ID from your message; [GUID] appears to be redacted.
4. Open the application and select Certificates & secrets → Certificates.
5. Upload the public portion of a new certificate. Keep its private key only in the application’s secure certificate store or Key Vault.
6. Update the application, pipeline, or service to use the new certificate and private key when generating its client assertion.
7. Request a new token. In Entra ID → Monitoring & health → Sign-in logs, verify that the credential’s Key ID corresponds to the newly registered certificate.
8. After successful validation, remove the expired certificate from Certificates & secrets.

Microsoft’s credential-rotation procedure specifies adding the new credential, updating the service, validating the new Key ID in sign-in logs, and only then removing the old credential.^1^

Do not merely generate another JWT with the expired private key—the corresponding registered public key is outside its validity period, so new assertions signed by it will continue to fail.

Verify the affected credential with Microsoft Graph

Microsoft Graph supports locating an application by its appId (Application/Client ID), which is different from the application object ID. Request keyCredentials explicitly because that property is not fully returned by default.^2^

GET https://graph.microsoft.com/v1.0/applications(appId='{client-id}')?
    $select=id,appId,displayName,keyCredentials
Authorization: Bearer {access-token}

Place the request on one line when using Graph Explorer or another HTTP client. Check each keyCredentials entry’s keyId, startDateTime, and endDateTime. The least-privileged delegated permission documented for reading the application is Application.Read.All; the signed-in user might also need an appropriate Microsoft Entra role.^2^

If this tenant is in Azure Government or Azure China, use that cloud’s matching portal, identity, and Microsoft Graph endpoints; tokens and endpoints are not interchangeable between national clouds.^3^

Important automation limitation

Because the certificate is already expired, do not use Microsoft Graph’s addKey action unless the application has another currently valid certificate. addKey requires proof of possession signed by an existing valid key. If every registered certificate has expired, use the portal procedure above or the Graph Update application operation instead.^4^

For future rotations, register the replacement certificate before the current one expires, deploy it to the application, switch signing to it, validate token acquisition, and then remove the old certificate.

The Request ID, Correlation ID, and timestamp should be retained if administrator or Microsoft support investigation is needed, but they do not replace rotating the expired credential.

References

1. Microsoft Entra recommendation: Renew expiring application credentials (preview)
2. Get application
3. Microsoft Graph national cloud deployments
4. application: addKey