3809932 - Error AADSTS7000222 when accessing Manage Document Grounding tool

When opening the Manage Document Grounding tool, the following error message is displayed:

"An application error occurred. Please try again later, or copy the below error information and send it to your support group if the issue keeps occurring."

When clicking Show Error, the following error details are shown:

"errorMessage=Exception while acquiring access token silently com.microsoft.aad.msal4j.MsalServiceException: AADSTS7000222: The provided client secret keys for app '...' are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds. [...]"

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."

SAP SuccessFactors HCM Suite

The error occurs because the Client Secret has expired on the Microsoft Entra side and has not been updated in the SAP SuccessFactors tenant and/or in the Contextualization SAP BTP destination (SFSF-<CompanyID>-DG-Context-Setup).

1) Generate a New Client Secret on Microsoft Entra

Refer to section "4. Create App Registration for Document Grounding with Application Permission (validate your existing setup)" in the SAP Community Blog Post - Joule - Document Grounding with Contextualization (aka Metadata to your Documents) - Setup Guide – 2.

2) Update the Contextualization SAP BTP Destination

1. Navigate to the SAP BTP Subaccount.
2. Click Destinations.
3. Locate the Context destination, typically named SFSF-<CompanyID>-DG-Context-Setup.
4. Update the Client Secret with the new value generated on the Microsoft Entra side.

For detailed instructions and screenshots, refer to step "6.1 Destination for Document Grounding Context" in the SAP Community Blog Post - Joule - Document Grounding with Contextualization (aka Metadata to your Documents) - Setup Guide – 2.

3) Update the Client Secret on the SAP SuccessFactors Side

1. Go to Admin Center > Security Center.
2. Click OAuth Configurations.
3. Locate the SharePoint OAuth configuration created automatically during the Document Grounding setup. This is an OAuth 2.0 integration with Client_Credentials grant type, usually named as SharePoint_OAuth_Integration_<Company ID>.
4. Click Edit (top-right corner of the screen). By default, only the Client ID is visible. The Client Secret field becomes available after clicking Edit.
5. Update the Client Secret with the new value generated on the Microsoft Entra side.
6. Click Save.

Document Grounding, Client Secret, expired, AADSTS7000222, Microsoft Entra, BTP, destination, OAuth, SharePoint, MsalServiceException, access token, Manage Document Grounding, SFSF, MS Entra, client secret keys, access, token, errorMessage, An application error occurred , KBA , LOD-SF-PLT-JOU , Joule in SuccessFactors , Problem