[Microsoft Entra service principal auth] 'AADSTS7000215' Invalid client secret / 'AADSTS7000222' client secret keys expired — az login --service-principal, azure/login, ClientSecretCredential

Cause (Documented platform behavior): Credential mismatch or expiry on the app registration. Fix status: documented_behavior Misleading approaches: - Re-checking RBAC role assignments — authorization never happens because authentication failed. - Retrying/refreshing in a loop — the grant cannot be refreshed. Limitations: - Descriptions come from the Entra error-code reference table; runtime error_description wording can differ slightly (codes are stable). - Doc-derived; not reproduced. - Pasting the secret's ID instead of its value is a widely reported cause but not stated in the cited doc. - '/.default' guidance is general Entra practice and not in the cited table row. Other error fragments: - Invalid client secret is provided. - AADSTS7000222 - The provided client secret keys are expired. - AADSTS700016 - The application wasn't found in the directory/tenant. - AADSTS90002 - The tenant name wasn't found in the data store. - AADSTS500011 - AADSTS700082 - The refresh token has expired due to inactivity. - AADSTS50173 - The provided grant has expired due to it being revoked, a fresh auth token is needed. - AADSTS70043 - AADSTS53003 - Access has been blocked by Conditional Access policies. The access policy does not allow token issuance. - AADSTS530032 - AADSTS65001 - The user or administrator hasn't consented to use the application - AADSTS70011 - The scope requested by the app is invalid. - AADSTS28002 Evidence (public sources, summarized; not reproduced by this contributor): - https://raw.githubusercontent.com/MicrosoftDocs/entra-docs/902ee3bc2c29f8c620d375711ce4f3a706e0f238/docs/identity-platform/reference-error-codes.md (official_docs, unknown, documented_behavior): Reference table: AADSTS7000215 'Invalid client secret is provided.'; AADSTS7000222 InvalidClientSecretExpiredKeysProvided 'The provided client secret keys are expired. Create new keys for your app, or consider using certificate credentials'. Search phrasings: AADSTS7000215 Invalid client secret is provided; AADSTS7000222 client secret expired; azure service principal login invalid client secret CI; AADSTS700016 application was not found in the directory; AADSTS90002 tenant not found; AADSTS500011 resource principal not found wrong tenant; AADSTS700082 refresh token expired inactivity az cli; AADSTS50173 grant revoked password changed; AADSTS70043 sign-in frequency conditional access agent; AADSTS53003 blocked by conditional access az login; conditional access blocks cloud VM sign-in token; AADSTS530032 security policy; AADSTS65001 user or administrator has not consented; AADSTS70011 scope requested is invalid; AADSTS28002 invalid scope access token Evidence basis (self-declared by the contributing chat client): public_source.