Client secrets are blocked by a tenant-wide policy. Contact your tenant administrator for more information.

The error is caused by a tenant-wide application management policy in Microsoft Entra ID that blocks adding client secrets (password credentials) to applications.

This setting is configured in the Microsoft Entra admin center under app management policies, or via Microsoft Graph:

1. An admin with one of these roles must make the change:
   • Security Administrator and Cloud App Administrator or Application Administrator, or
   • Global Administrator.
2. The relevant restriction is passwordAddition (and typically also symmetricKeyAddition) in the tenant-wide default app management policy. When configured to block, the portal shows “Client secrets are blocked by a tenant-wide policy”.
3. To adjust this, the admin can either:
   • Use the Microsoft Entra admin center (App management policy UX) to change the Block password addition setting, which controls passwordAddition and symmetricKeyAddition, or
   • Use Microsoft Graph (beta) to update the defaultAppManagementPolicy so that passwordAddition (and, if desired, symmetricKeyAddition) no longer block new secrets.
4. After updating the policy, confirm it is applied by:
   • Reading the default app management policy again and verifying the updated restrictions, and/or
   • Trying to create a new application secret; the operation should now succeed if the restriction has been relaxed.

If the policy must remain strict tenant-wide, a custom app management policy can be created and assigned to specific applications to exempt them from the restriction.

References:

• Configure restrictions on how applications can be configured
• Tutorial: Enforce secret and certificate standards using application management policies (ms-powershell)
• Tutorial: Enforce secret and certificate standards using application management policies (ms-graph)