AADSTS500031: Signing certificate for the app not found (fix)

What does AADSTS500031 mean?

Microsoft’s error code reference doesn’t list AADSTS500031 (checked 30 October 2026). The wording below comes from a user report.

A user on Microsoft Q&A posted this response from the token endpoint (/oauth2/v2.0/token):

HttpResponseCode = 400 (BadRequest)
ErrorMsg: AADSTS500031: Cannot find signing certificate configured

The user’s app was an Angular single-page app using the authorization code flow. It failed with two different client libraries. The user’s own accepted answer: “After adding a missing SAML certificate it works!” The steps were Enterprise applications > the app > Single sign-on > SAML > add the missing SAML Signing Certificate.

That is one report, from 2020. It shows one cause and one fix. It doesn’t explain the mechanism.

Our reading: Entra signs the tokens it issues for an app. When an enterprise app has its own signing certificate setting, as SAML apps do, Entra looked for it and found none.

A documented relative exists. Microsoft’s troubleshooting article for AADSTS50003, “No signing key configured”, covers SAML apps where “Microsoft Entra ID doesn’t recognize the certificate configured for the application.” Its fix is the same: create a new certificate and make it active.

Is it an attack?

No. The user report points to a configuration error on the enterprise app. Our reading: the certificate is missing on Entra’s side, so a caller can’t cause it by changing the request, and everyone who uses the app fails at once.

Pattern	Likely meaning
Every user of one app fails at the same moment	The signing certificate was removed, or never added. Likely, but unconfirmed.
A new SAML app fails on its first test	Single sign-on was set up but no certificate was saved. Likely; we haven’t tested this.
The app worked for years, then failed	Check the certificate’s expiry date. Microsoft’s certificate tutorial describes rollover and expiry. Whether an expired certificate produces this code is not documented.
An OAuth or OpenID Connect app fails with it	The user report above. The enterprise app had SAML settings without a certificate.

How do I find it in my logs (KQL)?

Microsoft doesn’t document which sign-in table AADSTS500031 is logged in. The user has signed in by then, so SigninLogs is the likely table. Check all three:

union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "500031"
| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable

Which apps fail, how many users, and over which protocol:

SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == "500031"
| summarize Rows = count(), Users = dcount(UserPrincipalName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by AppId, AppDisplayName, AuthenticationProtocol
| sort by Users desc

When the app last worked, which tells you when the certificate went missing:

SigninLogs
| where TimeGenerated > ago(30d)
| where AppId == "<app id from the query above>"
| summarize LastSuccess = maxif(TimeGenerated, ResultType == "0"), FirstFailure = minif(TimeGenerated, ResultType == "500031")

If LastSuccess is just before FirstFailure, look in the audit log for changes to the app around that time.

How do I fix AADSTS500031?

For the user: you can’t fix this. Tell IT which app failed. Everyone else is likely affected too.

For admins:

1. Open the Microsoft Entra admin center as at least a Cloud Application Administrator. Go to Entra ID > Enterprise apps > All applications and open the app.
2. Go to Single sign-on. Under SAML Certificates, select Edit. The page shows the status (Active or Inactive), expiry date and thumbprint of each certificate.
3. If there is no certificate, select New Certificate and Save. A new certificate starts as Inactive.
4. On the new row, select … > Make certificate active.
5. If the app is a SAML app, give the new certificate to the app or its vendor. Microsoft’s tutorial says to download it from the SAML Certificates section.
6. Watch for the expiry emails. Microsoft says it sends one “60, 30, and 7 days before the SAML certificate expires.”

For developers: if your OAuth or OpenID Connect app gets this error, check whether its enterprise app has single sign-on set to SAML with no certificate. Ask an admin to check the steps above. That is what fixed the user report.