AADSTS700027: The certificate with identifier used to sign the client assertion is not registered on application. [Reason - The key was not found

The error AADSTS700027: The certificate with identifier used to sign the client assertion is not registered on application means Microsoft Entra ID cannot find the certificate (key credential) on the app registration that is being used to sign the client assertion (JWT).

trustedCertificateSubjects in the application manifest does not register a certificate for client authentication. To use a certificate for app-only auth (client assertions), the certificate must be added to the app’s keyCredentials collection or uploaded via Certificates & secrets.

To fix the error without relying on trustedCertificateSubjects:

1. Compute the certificate values
   • From the X.509 certificate that is used to sign the client assertion, compute:
     • customKeyIdentifier = Base64-encoded thumbprint (hash) of the certificate.
     • key = Base64-encoded raw certificate data.
   • Generate a GUID for keyId.
2. Register the certificate in the app manifest
   • In the Entra ID App registrations blade for app 1, open Manifest.
   • Replace or extend the keyCredentials property with an entry for the certificate, for example:

          "keyCredentials": [
            {
              "customKeyIdentifier": "<base64Thumbprint>",
              "keyId": "<guid-key-id>",
              "type": "AsymmetricX509Cert",
              "usage": "Verify",
              "key": "<base64Value>"
            }
          ]
     

   • Save the manifest.
3. Ensure the same certificate is used to sign the client assertion
   • The private key corresponding to the registered certificate must be used to sign the JWT (client_assertion).
   • When calling the token endpoint, send:
     • client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
     • client_assertion=<signed JWT>
4. Retry the token request
   • After the certificate is correctly registered in keyCredentials and used to sign the assertion, the AADSTS700027 error should be resolved.

Note: Assigning Key Vault roles or using managed identity on the Key Vault does not by itself register the certificate on the Entra app. The app registration must explicitly contain the certificate in keyCredentials (either via upload in Certificates & secrets or via manifest as shown above).

References:

• Microsoft identity platform application authentication certificate credentials
• Azure Key Vault configuration provider in ASP.NET Core