When a generic OpenID Connect (OIDC) Identity Provider (IdP) uses Private Key JSON Web Token (JWT) authentication to federate Microsoft Entra ID users, authentication fails because Microsoft Entra ID requires the x5t#S256 parameter in the client_assertion JWT header. Administrators must configure the OIDC IdP in Okta to use Client Secret authentication instead of Private Key JWT to resolve this issue. When this issue occurs, Okta generates the following error:

400 Bad Request

Your request resulted in an error. Could not acquire access token from authorization code.
Identity Provider: OIDC, Error Code: invalid_social_token

Additionally, Microsoft Entra ID sign-in logs display the following error details:

Sign-in error code: 700027
Failure reason: Client assertion failed signature validation.
Additional details: Developer error - the app is attempting to sign in without the necessary or correct authentication parameters.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC)
• Identity Provider (IdP)
• Microsoft Entra ID
• Private Key JSON Web Token (JWT)

Microsoft Entra ID requires the x5t#S256 parameter in the client_assertion JWT header to validate signatures when using Private Key JWT authentication. While the Request for Comments (RFC) 7515 specification for JSON Web Signature (JWS) defines this header parameter as optional, the generic Okta OIDC IdP implementation does not send it. Because Microsoft Entra ID mandates this parameter, signature validation fails on the Entra ID side with error code 700027.

What resolves the invalid_social_token error when authenticating with Microsoft Entra ID?

Okta does not support Private Key JWT for generic OIDC IdP integrations with Microsoft Entra ID. Generate a new client secret in the Microsoft Entra Admin Center and update the Okta Identity Provider authentication method to use the Client Secret.

1. Log in to the Microsoft Entra Admin Center.
2. Navigate to Identity > Applications > App registrations and select the relevant application.
3. Select Certificates & secrets > Client secrets and create a new client secret if one does not already exist.
4. Copy the secret value.
5. Log in to the Okta Admin Console.
6. Navigate to Security > Identity Providers.
7. Locate the Microsoft Entra ID OIDC provider and select Edit.
8. Under the Authentication configuration, set the method to Client Secret.
9. Enter the copied Client Secret into the corresponding field.
10. Select Save.

Related References

• RFC 7515 - JSON Web Signature (JWS)