Error Message: JWT Signature is Invalid - User key is expired"

The error indicates that the credential used to sign the JWT (typically a client secret or certificate for a service principal) is expired. Even though no app registrations are visible, the issue is resolved by renewing the client secret in Microsoft Entra ID and then updating the dependent application with the new secret.

Use the following steps:

1. In the Azure portal, open Microsoft Entra ID.
2. Go to App registrations and ensure the filter is set to show All applications, not just “Owned applications.” Also check under your tenant’s subscriptions and directories if applicable.
3. Once the correct application is identified, open it and select Certificates & secrets.
4. Under Client secrets, create a New client secret to renew it. After creation, copy the new secret value that appears under the Key column.
5. Go to the application or service that uses this app registration (for example, CycleCloud or any other service using that service principal). In its configuration UI, locate the place where the Application Secret (client secret) is stored.
6. Replace the old secret with the new one and validate/save the configuration.

If the Surface user is authenticating through a service that relies on this service principal, updating the expired secret and saving the configuration will stop the “JWT Signature is Invalid – User key is expired” error on that device.

References:

• Client secret key is expired error occurs when deploying or terminating virtual machines