AADSTS50146

What it means

The app needs an app-specific signing key, which is missing, expired or not yet valid.

How to fix it

Check the SAML signing certificate on the Enterprise App and its expiry.

How to investigate

1. Compare what the app sends (client ID, redirect URI, scopes, tenant) with the app registration.
2. Decode the token or request: the JWT and SAML decoders on this site show exactly what was sent.
3. Check the app's credentials (secrets and certificates) and whether the service principal exists and is enabled in this tenant.
4. Search the sign-in logs for the request ID or correlation ID from the troubleshooting details on the error page.

Guides on this site

• Rolling a SAML signing certificate without an outage

Tools that help

• JWT decoder
• GUID lookup
• Microsoft's error lookup for 50146 ↗