Azure AD B2C Issuing JWT Tokens with Invalid Signatures

Question

Azure AD B2C Issuing JWT Tokens with Invalid Signatures

petehall 20

Azure AD B2C is intermittently issuing JWT access tokens with mathematically invalid RSA signatures. These tokens fail RSA.VerifyData() validation against the public keys published in the JWKS endpoint, even though:

1. The token's `kid` (Key ID) matches a key in the current JWKS
2. All token claims are valid (correct issuer, audience, not expired)
3. The token format is syntactically correct
4. No corruption occurs during transmission (byte-identical on repeated reads)

The oldest active signing key is 47 days old and may be faulted or corrupt.


Can you check the status of a signing key - I can specify which one.
   - Are there any known issues with this specific key?
   - Can you force removal/rotation of this key?

Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-04-09T13:33:44.9366667+00:00

Hello petehall

Thank you for reaching out to Microsoft Q&A.

We are currently checking with the internal team and we will get back to you shortly.

Thank you
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-04-09T14:25:16.8633333+00:00

Hello petehall,

From your description, the issue is that Azure AD B2C was intermittently issuing access tokens that looked valid in structure and claims, but the RSA signature could not be validated against the public signing keys published in the JWKS endpoint. You also observed that one older signing key appeared to be associated with the failures, so your follow-up question was whether Microsoft had disabled that key or lowered its priority.

As informed, Microsoft does not expose any customer-visible method to verify the health, priority, or current selection status of a specific B2C signing key. A key may still appear as active in the JWKS metadata but may no longer be selected for token issuance, and this can happen as part of normal internal key rollover behavior without any explicit notice.

Because of that, it is not possible to confirm from the outside whether the improvement came from a Microsoft-side change or from the code change implemented in your application. If the issue is no longer reproducible and tokens continue validating successfully, the best approach is to continue monitoring and treat the issue as resolved unless it reappears.
petehall 20 Reputation points

2026-04-09T14:50:45.3366667+00:00

I'll discuss the above with the development team. Quick question though, would a signing key be expected to be 47 days old?
petehall 20 Reputation points

2026-04-09T15:03:25.2066667+00:00

Can you arrange a private chat as I have diagnostic information I can share - I also do not want to implement more complex retry logic as yet
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-04-09T15:04:19.34+00:00

petehall yes, a signing key being ~47 days old is completely normal in Azure AD B2C.
petehall 20 Reputation points

2026-04-09T15:44:54.6733333+00:00

I need to know:
Can you check the status of a specific signing key?
Are there any logged errors in Azure AD's token signing service for this tenant?
Can you disable a specific key? That would test one theory

Regards
petehall 20 Reputation points

2026-04-10T07:18:43.21+00:00

I need to know: Can you check the status of a specific signing key? Are there any logged errors in Azure AD's token signing service for this tenant? Can you disable a specific key? That would test one theory

Regards
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-04-10T08:34:55.7533333+00:00

petehall I have Initiated a private message, Can you please decode the token in jwt.ms and paste the screenshot? in private message.
Kishor kumar Reddy Akki 50 Reputation points

2026-04-27T20:21:35.25+00:00

@VEMULA SRISAI Can you please initiate private with me, I need to discuss this issue with you in more detail.
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-04-28T09:38:24.67+00:00

Kishor kumar Reddy Akki could you please post a new question regarding this to discuss further on this.
Alex Burlachenko 25,285 Reputation points MVP Volunteer Moderator

2026-04-30T08:17:12.6533333+00:00
petehall hi & thx for join me here at Q&A portal,

this is not something u can validate or rotate yourself from tenant side. B2C signing keys for built in policies are msft managed, so if a token has valid kid, correct issuer/audience/expiry, but RSA signature fails against the published JWKS, thats a backend signing/JWKS consistency issue or key-serving issue.

first rule (lol) out local verifier bugs confirm u verify the exact header.payload bytes, use RS256 not HS256, fetch JWKS fresh without cache, and test with two independent JWT libraries. if both fail on same token and same kid, open ticket immediately and include tenant name, policy/user flow, issuer URL, kid, token timestamp, correlation ID if available and a redacted token sample if support asks for it.

pls dont post full tokens publicly. ask support guys specifically to check B2C signing key health and metadata propagation and request key rollover if they confirm fault.

rgds, Alex

&

if my answer helps pls accept it.

Your answer

Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-04-09T13:33:44.9366667+00:00

Hello petehall

Thank you for reaching out to Microsoft Q&A.

We are currently checking with the internal team and we will get back to you shortly.

Thank you
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-04-09T14:25:16.8633333+00:00

Hello petehall,

From your description, the issue is that Azure AD B2C was intermittently issuing access tokens that looked valid in structure and claims, but the RSA signature could not be validated against the public signing keys published in the JWKS endpoint. You also observed that one older signing key appeared to be associated with the failures, so your follow-up question was whether Microsoft had disabled that key or lowered its priority.

As informed, Microsoft does not expose any customer-visible method to verify the health, priority, or current selection status of a specific B2C signing key. A key may still appear as active in the JWKS metadata but may no longer be selected for token issuance, and this can happen as part of normal internal key rollover behavior without any explicit notice.

Because of that, it is not possible to confirm from the outside whether the improvement came from a Microsoft-side change or from the code change implemented in your application. If the issue is no longer reproducible and tokens continue validating successfully, the best approach is to continue monitoring and treat the issue as resolved unless it reappears.
petehall 20 Reputation points

2026-04-09T14:50:45.3366667+00:00

I'll discuss the above with the development team. Quick question though, would a signing key be expected to be 47 days old?
petehall 20 Reputation points

2026-04-09T15:03:25.2066667+00:00

Can you arrange a private chat as I have diagnostic information I can share - I also do not want to implement more complex retry logic as yet
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-04-09T15:04:19.34+00:00

petehall yes, a signing key being ~47 days old is completely normal in Azure AD B2C.
petehall 20 Reputation points

2026-04-09T15:44:54.6733333+00:00

I need to know:
Can you check the status of a specific signing key?
Are there any logged errors in Azure AD's token signing service for this tenant?
Can you disable a specific key? That would test one theory

Regards
petehall 20 Reputation points

2026-04-10T07:18:43.21+00:00

I need to know: Can you check the status of a specific signing key? Are there any logged errors in Azure AD's token signing service for this tenant? Can you disable a specific key? That would test one theory

Regards
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-04-10T08:34:55.7533333+00:00

petehall I have Initiated a private message, Can you please decode the token in jwt.ms and paste the screenshot? in private message.
Kishor kumar Reddy Akki 50 Reputation points

2026-04-27T20:21:35.25+00:00

@VEMULA SRISAI Can you please initiate private with me, I need to discuss this issue with you in more detail.
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-04-28T09:38:24.67+00:00

Kishor kumar Reddy Akki could you please post a new question regarding this to discuss further on this.
Alex Burlachenko 25,285 Reputation points MVP Volunteer Moderator

2026-04-30T08:17:12.6533333+00:00

petehall hi & thx for join me here at Q&A portal,

this is not something u can validate or rotate yourself from tenant side. B2C signing keys for built in policies are msft managed, so if a token has valid kid, correct issuer/audience/expiry, but RSA signature fails against the published JWKS, thats a backend signing/JWKS consistency issue or key-serving issue.

first rule (lol) out local verifier bugs confirm u verify the exact header.payload bytes, use RS256 not HS256, fetch JWKS fresh without cache, and test with two independent JWT libraries. if both fail on same token and same kid, open ticket immediately and include tenant name, policy/user flow, issuer URL, kid, token timestamp, correlation ID if available and a redacted token sample if support asks for it.

pls dont post full tokens publicly. ask support guys specifically to check B2C signing key health and metadata propagation and request key rollover if they confirm fault.

rgds, Alex

&

if my answer helps pls accept it.