App Service Certificate Out of Sync and DOES NOT SYNC

Hello this is still a problem and I would appreciate some assistance with my Azure account please.

Hello this is still a problem and I would appreciate some assistance with my Azure account please.

Hi @Mike-E-angelo , thanks for the update.

It's unusual for your Key Vault to have zero secrets and zero certificate objects when using an App Service Certificate (ASC). The ASC stores certificate versions as secrets, so there should always be at least one secret related to your domain.

If the Key Vault is empty, the renewal process can't add the new certificate, which leads to:

• Sync showing “success” but not making changes
• Rekey not creating a new version
• Linked private certificates staying out of sync
• Unable to import from Key Vault

This suggests a backend issue between the ASC and its Key Vault.

To check the setup:

1. Go to ASC >Certificate Configuration >Step 1 and click the Key Vault link.
2. Open Secrets (not Certificates) and see if any secret exists for your domain.
3. Review Access Policies / RBAC to ensure:

• Microsoft Azure App Service (App ID: abfa0a7c-a6b6-4736-8310-5855508787cd) has Get permissions.
  • Microsoft.Azure.CertificateRegistration (App ID: f3c21656-0979-4d16-8d37-6897a3a73bac) has Get/List/Delete on secrets.

If no secrets appear after these checks, the certificate renewal hasn't updated the Key Vault, and this can't be resolved from the portal alone.

At that point, a backend repair is needed to:

• restore the Key Vault linkage,
• resend the renewed certificate versions, or
• remap the ASC to a new Key Vault.

Once the correct secret is present, Sync should work and the out-of-sync warning will be resolved.

Reference:

https://learn.microsoft.com/azure/app-service/app-service-key-vault-references https://learn.microsoft.com/azure/app-service/configure-ssl-certificate#permissions-needed

Hi @Praneeth Maddali thank you for your reply. To start, I never said I had no secrets, only that I had no certificates. The secret is indeed in the key vault and has been updated for five years now. This year is the first year it has not updated.

Secondly, why is the interface stating it is successfully synchronized when that is clearly not the case? Is this not a bug? I hope you can understand the very obvious and present concern.

Hi @Mike-E-angelo

Thank you for clarifying. I understand now that the secret is present in your Key Vault and has worked properly in the past, but the recent renewal did not update it—the new expiry date isn’t showing, and the old thumbprint remains. The "Sync successful" message can be misleading when nothing actually changes, which is understandably frustrating since auto-renewal typically works without issues.

This is often caused by the renewal service not having permission to update (write to) the secret in Key Vault, preventing the new certificate version from being added, even though the ASC status is "Issued."

To resolve this:

1. Open your Key Vault in the Azure portal and go to Access policies (classic view).

2.Find or add a policy for Microsoft.Azure.CertificateRegistration:

• Search for it (App ID: f3c21649-0979-4721-ac85-b0216b2cf413, or try f3c21656-0979-4d16-8d37-6897a3a73bac if needed).
• Assign these Secret permissions: Get, List, Set, Delete.
• Save the changes.

3. In your App Service Certificate blade, select Rekey and Sync, then click Rekey to trigger a new issuance and update the secret.
4. Wait a few minutes, then click Sync.

5.Refresh the page and check the Key Vault secret versions—you should see a new one with a Jan 2027 expiry, and the "Out of Sync" warning should disappear.

This usually resolves renewal issues related to secret updates. For more information, see:

https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/troubleshoot-azure-app-service-certificates

https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-app-service-certificate?tabs=portal

If the secret still doesn’t update (look for "permission denied" errors in the Key Vault Activity log),

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.

Hi @Praneeth Maddali thank you for your reply. Please note that this Key Vault uses RBAC, not access policies, as you suggested. I again ask: why is the message stating that synchronization was successful when this clearly is not the case? Is this not a bug?

<This comment system is as broken as Azure... why can we not delete comments?>

Hi @Mike-E-angelo

Yes, I am referring to RBAC. Please add the necessary role assignments to the service principal, including the Microsoft.Azure.CertificateRegistration role and the Key Vault Reader role. Once these roles are assigned, perform a rekey and sync operation. After that, delete the old binding and re-add the certificate binding to update the information.

Hi @Praneeth Maddali thank you for your reply but I am confused. You did not mention RBAC at all in your previous reply but are now saying that you are? I am unclear what you mean by "service principal". If you mean those GUIDs nothing returns when I enter them.

Additionally, I will ask a third time as you seem to not be answering my question:

Why is the message stating that synchronization was successful when this clearly is not the case? Is this not a bug?

Thank you for your continued assistance.

To be sure @Praneeth Maddali this is what I see in RBAC and it's still not working after I re-sync:

Hi @Praneeth Maddali any update please?

Hi @Praneeth Maddali / @Aditya Nandula, any update please?

Hi @Aditya N and @Praneeth Maddali any update please?

I reported this issue January 22nd, 2026:

https://howlongagogo.com/date/2026/january/22

This was 14 days ago.

Hi @Aditya N and @Praneeth Maddali any update please?

I reported this issue January 22nd, 2026:

https://howlongagogo.com/date/2026/january/22

This was 15 days ago.

Hi @Praneeth Maddali it is 5 days later, any update please?

Hi @Praneeth Maddali another 5 days later, any update please?

Hi @Praneeth Maddali any update please? I reported this issue on January 22nd, 2026:

https://howlongagogo.com/date/2026/january/22

This was 26 days ago.

Further, I was told via private message 10 days ago that this issue had been "escalated," which seems like a long time to wait without any actual escalation. I hope the concern is understandable and that you can understand the concern. Thank you for any further assistance you can provide.

Hi @Shree Hima Bindu Maganti please scroll up on the message history, you can see that this question has already been asked by @Praneeth Maddali and was already answered. Why are you adding new people to the chat instead of carefully reviewing the history to see whether the information you are requesting has already been requested by a previous agent and provided by the customer? I hope you understand the concern and resulting frustration of having the customer repeat themselves multiple times after nearly a month of not replying. Thank you for your continued assistance.

Hi @Mike-E-angelo
Thank you for your clarification. The “Synchronization successful” message does not validate whether a new certificate version was written to Key Vault or whether the thumbprint changed. The Sync operation only verifies that the App Service Certificate is linked to the Key Vault and that the linkage metadata exists. It does not confirm that a new secret version was created or that bindings were updated.

Upon further review using investigation diagnostics, we are now seeing a specific error: “OPERATIONNOTPERMITTEDONKEYVAULT.” This indicates that the App Service Certificate resource is currently unable to perform the required secret operations on the associated Key Vault.

While the Sync operation returns “Synchronization successful,” that message only validates the linkage metadata. It does not confirm that the backend secret update completed successfully. In this case, the Key Vault is denying the required secret access (get/set/delete), which is preventing the certificate from properly synchronizing.

This explains why the certificate shows as “Issued” but remains out of sync. The issue is related to Key Vault access permissions rather than the portal or sync action itself.

Please verify that the App Service Certificate service principal has the required secret permissions on the Key Vault. Once access is properly configured, the synchronization should complete successfully.
https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex%2Crbac%2Cazure-cli#permissions-needed
https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/troubleshoot-azure-app-service-certificates?utm_source=chatgpt.com
Let me know if you have any further assistances needed.

Hi @Shree Hima Bindu Maganti thank you for your reply but wow that seems like a lot of words to explain a very obvious bug in your system. You are clearly stating to your user (and indeed 3 or 4 support personnel who have already attempted to assist) that there is a successful operation occurring, when the underlying issue and warning continues to display to the user. Why is there such an obvious disconnect between the operation result and message with the actual resulting warning being displayed to the user? I hope you can understand the concern.

As for the subscription and information, I have already provided this in the chat as requested many weeks ago, please confirm.

Hi @Shree Hima Bindu Maganti thank you for your reply. I am still very unclear why your system is declaring "successful sync" when the warning messages persist! Why is it not showing the underlying error message for any permissions precluding the warning message to clear?

Additionally, if you carefully review the history of this ticket, you can see that I have already posted the recommended permissions as provided by several agents thus far, and this has not resolved the issue.

Please take a moment to confirm the permissions as presented in the previous history and confirm the permissions are as expected. Thank you for your continued assistance.

Hi @Shree Hima Bindu Maganti / @Praneeth Maddali I received a notification that ticket #2602190040001844 has been closed, and this issue still persists. Why are you closing tickets without customer confirmation?