Microsoft Entra Workload ID
TroubleshootingTroubleshoot Revoked Credentials
In brief
The documentation now states that tenant administrators or Microsoft can revoke application credentials, including credentials stolen or added by a threat actor.
What Entra admins need to know
Administrators can better identify who may have revoked a credential when troubleshooting access issues.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Understand why a credential was revoked
Tenant administrators or Microsoft can revoke credentials. Microsoft can revoke a credential in your tenant after detecting that a threat actor compromised it. TheThis can include a threat actor might have stolenstealing an existing credential or addedadding a credential to an application ora service principal to gain access.or application object.
The tokenRevocations property records revocations on an application or service principal. Revoking a credential has the following effects:
@@ -26,7 +26,7 @@ In these messages, `{X}` is the application's application (client) ID, and `{Y}` ## Understand why a credential was revoked -Microsoft can revoke a credential in your tenant after detecting that a threat actor compromised it. The threat actor might have stolen an existing credential or added a credential to an application or service principal to gain access.+Tenant administrators or Microsoft can revoke credentials. Microsoft can revoke a credential in your tenant after detecting that a threat actor compromised it. This can include a threat actor stealing an existing credential or adding a credential to a service principal or application object. The `tokenRevocations` property records revocations on an application or service principal. Revoking a credential has the following effects: