# AADSTS500031: Signing certificate for the app not found (fix)

Canonical: https://brambrinkmeier.com/entra/aadsts/500031/
By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/500031.json

**Short answer:** AADSTS500031 means Entra couldn't find a signing certificate configured for the app. Microsoft doesn't list the code. The one user report we found was fixed by adding a SAML signing certificate to the enterprise app. It is a configuration error with low attack value. Check the app's SAML Certificates section and make sure a valid certificate is active.

**Fix:** Admin: open the enterprise app > Single sign-on > SAML Certificates > Edit. If no certificate is there, select New Certificate, Save, then Make certificate active, and give it to the app vendor. This fixed the one user report we found. User: tell IT which app failed.

| Field | Value |
|---|---|
| Code | AADSTS500031 |
| Category | App configuration |
| Type | Configuration error |
| Attack signal | Low: usually configuration or user error |
| In Microsoft's error reference | No (checked 2026-10-30) |
| Verification | documentation |
| Last updated | 2026-10-30 |

## What does AADSTS500031 mean?

Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS500031 (checked 30 October 2026). The wording below comes from a user report.

A user on Microsoft Q&A posted this response from the token endpoint (`/oauth2/v2.0/token`):

```
HttpResponseCode = 400 (BadRequest)
ErrorMsg: AADSTS500031: Cannot find signing certificate configured
```

The user's app was an Angular single-page app using the authorization code flow. It failed with two different client libraries. The user's own accepted answer: *"After adding a missing SAML certificate it works!"* The steps were **Enterprise applications** > the app > **Single sign-on** > **SAML** > add the missing **SAML Signing Certificate**.

That is one report, from 2020. It shows one cause and one fix. It doesn't explain the mechanism.

Our reading: Entra signs the tokens it issues for an app. When an enterprise app has its own signing certificate setting, as SAML apps do, Entra looked for it and found none.

A documented relative exists. [Microsoft's troubleshooting article](https://learn.microsoft.com/troubleshoot/azure/active-directory/error-code-aadsts50003-cert-or-key-not-configured) for AADSTS50003, *"No signing key configured"*, covers SAML apps where *"Microsoft Entra ID doesn't recognize the certificate configured for the application."* Its fix is the same: create a new certificate and make it active.

## Is it an attack?

No. The user report points to a configuration error on the enterprise app. Our reading: the certificate is missing on Entra's side, so a caller can't cause it by changing the request, and everyone who uses the app fails at once.

| Pattern | Likely meaning |
|---|---|
| Every user of one app fails at the same moment | The signing certificate was removed, or never added. Likely, but unconfirmed. |
| A new SAML app fails on its first test | Single sign-on was set up but no certificate was saved. Likely; we haven't tested this. |
| The app worked for years, then failed | Check the certificate's expiry date. Microsoft's certificate tutorial describes rollover and expiry. Whether an expired certificate produces this code is not documented. |
| An OAuth or OpenID Connect app fails with it | The user report above. The enterprise app had SAML settings without a certificate. |

## How do I find it in my logs (KQL)?

Microsoft doesn't document which sign-in table AADSTS500031 is logged in. The user has signed in by then, so `SigninLogs` is the likely table. Check all three:

```kusto
union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "500031"
| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable
```

Which apps fail, how many users, and over which protocol:

```kusto
SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == "500031"
| summarize Rows = count(), Users = dcount(UserPrincipalName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by AppId, AppDisplayName, AuthenticationProtocol
| sort by Users desc
```

When the app last worked, which tells you when the certificate went missing:

```kusto
SigninLogs
| where TimeGenerated > ago(30d)
| where AppId == "<app id from the query above>"
| summarize LastSuccess = maxif(TimeGenerated, ResultType == "0"), FirstFailure = minif(TimeGenerated, ResultType == "500031")
```

If `LastSuccess` is just before `FirstFailure`, look in the audit log for changes to the app around that time.

## How do I fix AADSTS500031?

**For the user:** you can't fix this. Tell IT which app failed. Everyone else is likely affected too.

**For admins:**
1. Open the Microsoft Entra admin center as at least a Cloud Application Administrator. Go to **Entra ID** > **Enterprise apps** > **All applications** and open the app.
2. Go to **Single sign-on**. Under **SAML Certificates**, select **Edit**. The page shows the status (**Active** or **Inactive**), expiry date and thumbprint of each certificate.
3. If there is no certificate, select **New Certificate** and **Save**. A new certificate starts as **Inactive**.
4. On the new row, select **...** > **Make certificate active**.
5. If the app is a SAML app, give the new certificate to the app or its vendor. Microsoft's tutorial says to download it from the **SAML Certificates** section.
6. Watch for the expiry emails. Microsoft says it sends one *"60, 30, and 7 days before the SAML certificate expires."*

**For developers:** if your OAuth or OpenID Connect app gets this error, check whether its enterprise app has single sign-on set to SAML with no certificate. Ask an admin to check the steps above. That is what fixed the user report.

## Evidence

Not in Microsoft's error reference and not reproduced in the lab; built from lab results, other Microsoft pages and user reports, which the page names.

## Sources

1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/entra/identity-platform/reference-error-codes)
2. [AADSTS500031: Cannot find signing certificate configured (Microsoft Q&A)](https://learn.microsoft.com/en-us/answers/questions/141320/aadsts500031-cannot-find-signing-certificate-confi)
3. [Tutorial: Manage certificates for federated single sign-on](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-manage-certificates-for-federated-single-sign-on)
4. [Error AADSTS50003 - No signing key configured](https://learn.microsoft.com/troubleshoot/azure/active-directory/error-code-aadsts50003-cert-or-key-not-configured)
5. [SigninLogs table reference (Azure Monitor)](https://docs.azure.cn/en-us/azure-monitor/reference/tables/SigninLogs)

## Related codes

[AADSTS75011](https://brambrinkmeier.com/entra/aadsts/75011/), [AADSTS50011](https://brambrinkmeier.com/entra/aadsts/50011/), [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/), [AADSTS650056](https://brambrinkmeier.com/entra/aadsts/650056/)

## License and citation

CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.

Cite as: Bram Brinkmeier, "AADSTS500031: Signing certificate for the app not found (fix)", https://brambrinkmeier.com/entra/aadsts/500031/ (CC BY 4.0), last updated 2026-10-30.