Troubleshooting: AADSTS500276 in Entra ID Custom Controls After Updating the Signing Certificate

Version Affected: All

 

Overview

After updating the signing certificate used by a Microsoft Entra ID Conditional Access Custom Control, authentication through that Custom Control fails with error code AADSTS500276: "Token presented by external identity provider has failed signature validation."

Cause

Microsoft Entra ID caches the response from the Custom Control's JSON Web Key Set (JWKS) discovery URL, which is where Entra ID looks up the signing certificate. After the certificate is updated, Entra ID keeps using the cached (old) key set until the cache expires, so tokens signed with the new certificate fail signature validation in the meantime.

Resolution

Waiting for the cached response to expire on its own resolves this, but if that isn't an option, use a new discovery URL instead so Entra ID has nothing stale to cache:

1. Create a new Custom Controls realm in SecureAuth IdP, or create an alias for the existing realm, and configure it with the new signing certificate.
2. Get the new realm or alias whitelisted in SecureAuth's Entra ID tenant. This takes effect immediately.
3. Create a new Custom Control configuration in Entra ID that uses the new realm or alias.
4. Create a new Conditional Access policy using the new Custom Control, and assign it to a small group of test users.
5. Test thoroughly with the test user accounts.
6. Once testing confirms the new Custom Control works, update all Conditional Access policies that use the old Custom Control to use the new one instead.

Steps 1 through 5 can be completed in advance, so the actual cutover in step 6 can happen during a maintenance window.

 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.