This message was deleted.

You can choose the duration of the client secret. When refreshing if you’re having token error, that’s just a GUI thing. As soon as your NetScaler is able to reach the AAD token endpoint, it will not rotate. See some details here, hope it helps https://www.julianjakob.com/citrix-netscaler-oauth-to-azure-ad-with-login_hint-subject-field/

Thanks Julian - I did pull up your article the other day. We are getting an “Error trying to validate Access Token” message when we go to the OAuth VIP and after authenticating to AAD (successfully). There is no error in the NetScaler GUI, all looks well. I spoke to Citrix and they wanted to know what the Client Secret was and I told them it’s constantly rotating. They then said “We’ve never seen that behavior before, that is wrong and is causing your issue”. But we have a build exactly same as this, in a lab, going to a different AAD Enterprise App & Web Server and it is working, and does the same. So I knew that assessment by them was likely wrong.

I've never seen NS rotating the actual value... I think the secret is static. However the value you see in GUI or CLI is encrypted jibberish, no the actual value. Also, what's the status of your OAuth action? That should give you some info whether NS is able to connect to the IdP.