Need to understand reasoning behind few of the recommendations

[spmanjunath]

I wanted to understand reasoning behind below recommendations, I myself have been tasked with recommending practices for handling expired secrets. I suspect some of the below might be related to caching, it would be of great help to understand the rational for the same.

1. Why is it that we need to wait minimum of 7 days after expiration to remove the secrets? Especially when the new secrets are recommended to be created minimum 30 days before - this of course implies that the new secret is immediately updated in the respective configuration stores.
2. If the secrets are already expired wouldn't it cause errors, irrespective of it not being present in ACS? So, does it really matter deleting expired secrets after its expiry.

We recommend to create new secrets a minimum of 30 days before they expire. This gives you a month of time before the old credentials expire.

We recommend to only remove secrets a minimum of 7 days after expiration, provided you have removed them from the application configuration.

Removing an expired secret from ACS before you remove it from the application configuration will cause errors.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 3d9d8235-c495-a7a3-a4a6-0d073db41d1d
• Version Independent ID: bdd22da6-06c6-569d-fccf-fd55baa3cef8
• Content: Replace an expiring client secret in a SharePoint Add-in
• Content Source: docs/sp-add-ins/replace-an-expiring-client-secret-in-a-sharepoint-add-in.md
• Product: sharepoint
• GitHub Login: @VesaJuvonen
• Microsoft Alias: vesaj

Thank you for reporting this issue. We will be triaging your incoming issue as soon as possible.

[github-actions]

Thank you for taking the time to file an issue. We periodically archive older or inactive issues as part of our issue management process, which automatically closes them once they are archived.

If you’d like to understand more about why and how we handle archived (closed) issues, please see Our approach to closed issues.

We appreciate your contribution and if this is still an active issue with the latest SPFx versions, please do resubmit the details. We needed to perform a cleanup, so that we can start with a clean table with a new process. We apologize for the inconvenience this might cause.