We are getting below error

"error_message": "[E062209] Token exchange with OAuth provider failed, please validate your OAuth setup: Failed to exchange OAuth base token [error: oauth2: \"invalid_client\" \"AADSTS7000222: The provided client secret keys for app '6a6efabd-078f-46f6-8a3c-98ca107af948' are expired. Visit the Azure portal to create new keys for your app: <https://aka.ms/NewClientSecret>, or consider using certificate credentials for added security: <https://aka.ms/certCreds>. Trace ID: 8e4593fd-639f-45c2-ab0c-63271a830a00 Correlation ID: 6454134b-6ee8-4ef2-9d68-9265b0bd504f Timestamp: 2026-03-16 13:32:44Z\" \"<https://login.microsoftonline.com/error?code=7000222>\"]"

Azure Client Secret Expired Your Azure AD OAuth client secret has expired. The error

AADSTS7000222

indicates Microsoft rejected the authentication because the client secret for app ID

6a6efabd-078f-46f6-8a3c-98ca107af948

is no longer valid. Fix Steps 1. Go to Azure Portal and navigate to your app registration 2. Select "Certificates & secrets" from the left menu 3. Create a new client secret in the "Client secrets" section 4. Copy the new secret value immediately (it won't be shown again)

# Update your Descope OAuth provider configuration with the new secret

5. In Descope console, go to Authentication Methods > Social (OAuth) 6. Find your Microsoft/Azure provider 7. Update the Client Secret field with the new value from step 4 8. Save the configuration • The client secret in Azure has an expiration date that you set when creating it • You'll need to update both Azure (create new secret) and Descope (update configuration) to restore OAuth functionality Custom OAuth Providers Overview | Descope Documentation

We are using Descope Microsoft account

Update Microsoft OAuth in Descope Console Since you're using Descope's Microsoft OAuth provider, you need to update the client secret in your Descope configuration. Steps to Update 1. Go to Descope Console Authentication Methods 2. Find Microsoft under Social Login providers 3. Click "Use my own account" if not already configured

# Navigate to Microsoft OAuth configuration

4. Update the Client Secret field with your new Azure client secret 5. Ensure Client ID matches your Azure app ID:

6a6efabd-078f-46f6-8a3c-98ca107af948

6. Save the configuration Verify Configuration • Client ID should be your Azure Application (client) ID • Client Secret should be the new secret value from Azure portal • Callback URI should be

<https://api.descope.com/v1/oauth/callback>

Custom Social Login with Microsoft | Descope Documentation

@Pawan Goyal for production you should use your own Microsoft app for oauth