_White_Background_square_1920px.png?width=256&height=96&name=FLEETWATCH%20Fleet%20Information%20Technology%20by%20S%26A%20Systems%2c%20Inc%20(06_28_2021)_White_Background_square_1920px.png)
Fleetwatch Cloud · SSO Login
What Do I Do When Our SSO Client Secret Expires?
Single sign-on (SSO) to Data Tools uses a client secret that your agency creates in Microsoft Entra ID (formerly Azure AD). Every client secret has an expiration date. When it expires, no one can sign in with SSO until your Entra ID admin creates a new secret and sends it to Fleetwatch.
Who does this? Your agency’s IT department or Entra ID administrator. Fleetwatch can’t create the secret for you, because it lives in your agency’s Microsoft tenant. If you’re not an admin, send this article to your IT department.
How to Tell the Secret Has Expired
- SSO sign-in to Data Tools suddenly stops working for everyone at your agency, not just one user.
- The Microsoft sign-in error mentions AADSTS7000222 or says the client secret keys “are expired.”
- In Entra ID, the secret under Certificates & secrets shows an Expires date that has passed (see step 4 below).
What Fleetwatch Uses for Your SSO Login
When SSO was set up, your agency sent Fleetwatch these four values. When a secret expires, only the last two change.
| Value | What it is | Changes when the secret expires? |
|---|---|---|
| Application (client) ID | Identifies your agency’s Fleetwatch Cloud app in Entra ID | No |
| Directory (tenant) ID | Identifies your agency’s Microsoft tenant | No |
| Secret Value | The secret itself, a long string of letters, numbers and symbols | Yes, a new one is needed |
| Secret ID | A GUID that identifies which secret is in use | Yes, a new one is needed |
Create a New Client Secret
These steps are done by your Entra ID admin.
| 1 | Sign in to the Microsoft Entra admin center as at least an Application Administrator or Cloud Application Administrator, or as an owner of the app. |
| 2 | Go to Entra ID > App registrations and select the All applications tab. |
| 3 | Search for your agency’s Fleetwatch Cloud app and open it. It’s usually named after your agency, such as <Agency> Fleetwatch Cloud. To be sure it’s the right app, its Application (client) ID should match the one you gave Fleetwatch. |
| 4 | Under Manage, select Certificates & secrets, then the Client secrets tab. Check the Expires column to confirm the old secret has expired. |
| 5 | Click New client secret. |
| 6 | Enter a Description you’ll recognize later, such as Fleetwatch Data Tools 2026, and pick an Expires period. The longest Microsoft allows is 24 months, but your agency’s policy may set a shorter limit. |
| 7 | Click Add. |
| 8 | Copy the Value right away and save it somewhere safe. Also copy the Secret ID. |
The Secret Value is shown only once. After you leave the page, Microsoft hides it for good. If you lose it, create another new secret. Also make sure you copy the Value column, not only the Secret ID. It’s the most common mix-up.
Send the New Secret to Fleetwatch
| 9 | Send the new Secret Value and Secret ID to Fleetwatch Support. Use a secure method your agency approves, such as encrypted email or a secure file share. The secret works like a password. |
| 10 | Fleetwatch’s cloud engineers update your Data Tools SSO settings and work with you to confirm users can sign in again. |
| 11 | Once sign-in works, go back to Certificates & secrets and delete the old expired secret so it doesn’t cause confusion later. |
Your Users and Groups Don’t Change
Most agencies give Data Tools access through Entra ID security groups assigned to the Fleetwatch Cloud app, like the ones below. A new client secret doesn’t touch these groups or their members, so users keep the same Data Tools access once the new secret is in place.
Example: one Entra ID group for each Data Tools access level. Your agency’s name is the prefix on each group.
Avoid the Outage Next Time
- Note the new secret’s Expires date and set a calendar reminder about 30 days before.
- You can create the new secret before the old one expires, because an app can have more than one active secret at a time. Send the new one to Fleetwatch while the old one still works, and the change happens with no sign-in outage.
- Keep the Description up to date (for example, with the year) so it’s easy to tell secrets apart.
Don’t create a new app registration to fix an expired secret. A new app gets a new Application ID, which means Fleetwatch would have to set up SSO again. Just add a new secret to the existing app.
Can’t sign in, or not sure which app is yours? Contact Fleetwatch Support and our cloud engineers will help you get SSO working again.