Problem:
Microsoft Entra ID-based security groups have been configured for filter conditions and have stopped working.
Description:
Microsoft Entra ID-based security group lookups have stopped working because the provided secret keys have expired. As a result, the ProfileUnity client cannot properly validate the filter conditions.
Note: The expiration of the client secret is set when a new client secret is added.
ProfileUnity logs will show the following error when trying to look up the Entra ID based security group:
The provided client secret keys for app 'Application (client) ID' are expired.
By default, logs will be saved in %temp%\ProfileUnity. Several logs will show the error. The client_Logon*.log will most likely be the simplest to review.
Resolution:
Reset the client secret key in the Azure\Entra portal.
- Log into the MS Entra Admin Center.
- Navigate to App Registrations and select the application that was created for ProfileUnity filter\group lookups. You can search for the application using the Application (client) ID in the error message.
- Select Certificates & Secrets and click on New client Secret.
- Add a Description and set the Expiration.
https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials?tabs=client-secret
Currently the expiration options are:- 90 Days (3 months)
- 180 Days (6 months)
- 365 Days (12 months)
- 760 Days (24 months)
- Custom start date and end date.
Note: It's highly recommended to make note of the expiration date and schedule maintenance of the client secret before the expiration date. Choose the longest duration allowed by your organization.
- Copy the Secret value. You will need this later. This secret value is never displayed again after you leave this page.
Update the ProfileUnity Console
- Login to the ProfileUnity Console web UI as an Administrator-level account and navigate to the Administration > Access and Authentication tab in the upper-right.
- Under Directory Services edit the Microsoft Entra ID group.
- Update the Client Secret Value and click on Save.
- Redeploy your configuration.
Similar KB
https://support.liquidware.com/hc/en-us/articles/37663340443917-HOWTO-Update-the-Client-Secret-information-for-Microsoft-EntraID-for-Use-with-Security-Group-Filters-in-ProfileUnity