{
  "schemaVersion": "1.0",
  "code": "500031",
  "name": null,
  "title": "AADSTS500031: Signing certificate for the app not found (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/500031/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/500031.md",
    "json": "https://brambrinkmeier.com/api/aadsts/500031.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/500031/"
  },
  "description": "AADSTS500031: Entra found no signing certificate for the app. Unlisted by Microsoft. Users fixed it by adding a SAML signing certificate. KQL.",
  "summary": "AADSTS500031 means Entra couldn't find a signing certificate configured for the app. Microsoft doesn't list the code. The one user report we found was fixed by adding a SAML signing certificate to the enterprise app. It is a configuration error with low attack value. Check the app's SAML Certificates section and make sure a valid certificate is active.",
  "inMicrosoftReference": false,
  "unlistedChecked": "2026-10-30",
  "meaningText": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS500031 (checked 30 October 2026). The wording below comes from a user report.\n\nA user on Microsoft Q&A posted this response from the token endpoint (`/oauth2/v2.0/token`):\n\n```\nHttpResponseCode = 400 (BadRequest)\nErrorMsg: AADSTS500031: Cannot find signing certificate configured\n```\n\nThe user's app was an Angular single-page app using the authorization code flow. It failed with two different client libraries. The user's own accepted answer: *\"After adding a missing SAML certificate it works!\"* The steps were **Enterprise applications** > the app > **Single sign-on** > **SAML** > add the missing **SAML Signing Certificate**.\n\nThat is one report, from 2020. It shows one cause and one fix. It doesn't explain the mechanism.\n\nOur reading: Entra signs the tokens it issues for an app. When an enterprise app has its own signing certificate setting, as SAML apps do, Entra looked for it and found none.\n\nA documented relative exists. [Microsoft's troubleshooting article](https://learn.microsoft.com/troubleshoot/azure/active-directory/error-code-aadsts50003-cert-or-key-not-configured) for AADSTS50003, *\"No signing key configured\"*, covers SAML apps where *\"Microsoft Entra ID doesn't recognize the certificate configured for the application.\"* Its fix is the same: create a new certificate and make it active.",
  "sections": [
    {
      "heading": "What does AADSTS500031 mean?",
      "text": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS500031 (checked 30 October 2026). The wording below comes from a user report.\n\nA user on Microsoft Q&A posted this response from the token endpoint (`/oauth2/v2.0/token`):\n\n```\nHttpResponseCode = 400 (BadRequest)\nErrorMsg: AADSTS500031: Cannot find signing certificate configured\n```\n\nThe user's app was an Angular single-page app using the authorization code flow. It failed with two different client libraries. The user's own accepted answer: *\"After adding a missing SAML certificate it works!\"* The steps were **Enterprise applications** > the app > **Single sign-on** > **SAML** > add the missing **SAML Signing Certificate**.\n\nThat is one report, from 2020. It shows one cause and one fix. It doesn't explain the mechanism.\n\nOur reading: Entra signs the tokens it issues for an app. When an enterprise app has its own signing certificate setting, as SAML apps do, Entra looked for it and found none.\n\nA documented relative exists. [Microsoft's troubleshooting article](https://learn.microsoft.com/troubleshoot/azure/active-directory/error-code-aadsts50003-cert-or-key-not-configured) for AADSTS50003, *\"No signing key configured\"*, covers SAML apps where *\"Microsoft Entra ID doesn't recognize the certificate configured for the application.\"* Its fix is the same: create a new certificate and make it active."
    },
    {
      "heading": "Is it an attack?",
      "text": "No. The user report points to a configuration error on the enterprise app. Our reading: the certificate is missing on Entra's side, so a caller can't cause it by changing the request, and everyone who uses the app fails at once.\n\n| Pattern | Likely meaning |\n|---|---|\n| Every user of one app fails at the same moment | The signing certificate was removed, or never added. Likely, but unconfirmed. |\n| A new SAML app fails on its first test | Single sign-on was set up but no certificate was saved. Likely; we haven't tested this. |\n| The app worked for years, then failed | Check the certificate's expiry date. Microsoft's certificate tutorial describes rollover and expiry. Whether an expired certificate produces this code is not documented. |\n| An OAuth or OpenID Connect app fails with it | The user report above. The enterprise app had SAML settings without a certificate. |"
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which sign-in table AADSTS500031 is logged in. The user has signed in by then, so `SigninLogs` is the likely table. Check all three:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500031\"\n| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable\n```\n\nWhich apps fail, how many users, and over which protocol:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500031\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n    by AppId, AppDisplayName, AuthenticationProtocol\n| sort by Users desc\n```\n\nWhen the app last worked, which tells you when the certificate went missing:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(30d)\n| where AppId == \"<app id from the query above>\"\n| summarize LastSuccess = maxif(TimeGenerated, ResultType == \"0\"), FirstFailure = minif(TimeGenerated, ResultType == \"500031\")\n```\n\nIf `LastSuccess` is just before `FirstFailure`, look in the audit log for changes to the app around that time."
    },
    {
      "heading": "How do I fix AADSTS500031?",
      "text": "**For the user:** you can't fix this. Tell IT which app failed. Everyone else is likely affected too.\n\n**For admins:**\n1. Open the Microsoft Entra admin center as at least a Cloud Application Administrator. Go to **Entra ID** > **Enterprise apps** > **All applications** and open the app.\n2. Go to **Single sign-on**. Under **SAML Certificates**, select **Edit**. The page shows the status (**Active** or **Inactive**), expiry date and thumbprint of each certificate.\n3. If there is no certificate, select **New Certificate** and **Save**. A new certificate starts as **Inactive**.\n4. On the new row, select **...** > **Make certificate active**.\n5. If the app is a SAML app, give the new certificate to the app or its vendor. Microsoft's tutorial says to download it from the **SAML Certificates** section.\n6. Watch for the expiry emails. Microsoft says it sends one *\"60, 30, and 7 days before the SAML certificate expires.\"*\n\n**For developers:** if your OAuth or OpenID Connect app gets this error, check whether its enterprise app has single sign-on set to SAML with no certificate. Ask an admin to check the steps above. That is what fixed the user report."
    }
  ],
  "microsoftWording": null,
  "securityReading": {
    "category": {
      "id": "app-config",
      "label": "App configuration"
    },
    "kind": {
      "id": "config",
      "label": "Configuration error"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "No. The user report points to a configuration error on the enterprise app. Our reading: the certificate is missing on Entra's side, so a caller can't cause it by changing the request, and everyone who uses the app fails at once.\n\n| Pattern | Likely meaning |\n|---|---|\n| Every user of one app fails at the same moment | The signing certificate was removed, or never added. Likely, but unconfirmed. |\n| A new SAML app fails on its first test | Single sign-on was set up but no certificate was saved. Likely; we haven't tested this. |\n| The app worked for years, then failed | Check the certificate's expiry date. Microsoft's certificate tutorial describes rollover and expiry. Whether an expired certificate produces this code is not documented. |\n| An OAuth or OpenID Connect app fails with it | The user report above. The enterprise app had SAML settings without a certificate. |",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which sign-in table AADSTS500031 is logged in. The user has signed in by then, so `SigninLogs` is the likely table. Check all three:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500031\"\n| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable"
    },
    {
      "title": null,
      "leadIn": "Which apps fail, how many users, and over which protocol:",
      "query": "SigninLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500031\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n    by AppId, AppDisplayName, AuthenticationProtocol\n| sort by Users desc"
    },
    {
      "title": null,
      "leadIn": "When the app last worked, which tells you when the certificate went missing:",
      "query": "SigninLogs\n| where TimeGenerated > ago(30d)\n| where AppId == \"<app id from the query above>\"\n| summarize LastSuccess = maxif(TimeGenerated, ResultType == \"0\"), FirstFailure = minif(TimeGenerated, ResultType == \"500031\")"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which sign-in table AADSTS500031 is logged in. The user has signed in by then, so `SigninLogs` is the likely table. Check all three:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500031\"\n| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable\n```\n\nWhich apps fail, how many users, and over which protocol:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500031\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n    by AppId, AppDisplayName, AuthenticationProtocol\n| sort by Users desc\n```\n\nWhen the app last worked, which tells you when the certificate went missing:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(30d)\n| where AppId == \"<app id from the query above>\"\n| summarize LastSuccess = maxif(TimeGenerated, ResultType == \"0\"), FirstFailure = minif(TimeGenerated, ResultType == \"500031\")\n```\n\nIf `LastSuccess` is just before `FirstFailure`, look in the audit log for changes to the app around that time.",
  "fix": {
    "short": "Admin: open the enterprise app > Single sign-on > SAML Certificates > Edit. If no certificate is there, select New Certificate, Save, then Make certificate active, and give it to the app vendor. This fixed the one user report we found. User: tell IT which app failed.",
    "steps": "**For the user:** you can't fix this. Tell IT which app failed. Everyone else is likely affected too.\n\n**For admins:**\n1. Open the Microsoft Entra admin center as at least a Cloud Application Administrator. Go to **Entra ID** > **Enterprise apps** > **All applications** and open the app.\n2. Go to **Single sign-on**. Under **SAML Certificates**, select **Edit**. The page shows the status (**Active** or **Inactive**), expiry date and thumbprint of each certificate.\n3. If there is no certificate, select **New Certificate** and **Save**. A new certificate starts as **Inactive**.\n4. On the new row, select **...** > **Make certificate active**.\n5. If the app is a SAML app, give the new certificate to the app or its vendor. Microsoft's tutorial says to download it from the **SAML Certificates** section.\n6. Watch for the expiry emails. Microsoft says it sends one *\"60, 30, and 7 days before the SAML certificate expires.\"*\n\n**For developers:** if your OAuth or OpenID Connect app gets this error, check whether its enterprise app has single sign-on set to SAML with no certificate. Ask an admin to check the steps above. That is what fixed the user report."
  },
  "labReproduced": null,
  "labSectionText": null,
  "labRuns": [],
  "verification": "documentation",
  "related": [
    "75011",
    "50011",
    "700016",
    "650056"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "AADSTS500031: Cannot find signing certificate configured (Microsoft Q&A)",
      "url": "https://learn.microsoft.com/en-us/answers/questions/141320/aadsts500031-cannot-find-signing-certificate-confi"
    },
    {
      "title": "Tutorial: Manage certificates for federated single sign-on",
      "url": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-manage-certificates-for-federated-single-sign-on"
    },
    {
      "title": "Error AADSTS50003 - No signing key configured",
      "url": "https://learn.microsoft.com/troubleshoot/azure/active-directory/error-code-aadsts50003-cert-or-key-not-configured"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://docs.azure.cn/en-us/azure-monitor/reference/tables/SigninLogs"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS500031: Signing certificate for the app not found (fix)\", https://brambrinkmeier.com/entra/aadsts/500031/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=500031"
}