Merge pull request #10882 from MicrosoftDocs/main

Auto Publish – main to live - 2025-12-30 06:00 UTC

Author: learn-build-service-prod[bot]

docs/identity/app-proxy/application-proxy-faq.yml

@@ -6,7 +6,7 @@ metadata:
   ms.service: entra-id
   ms.subservice: app-proxy
   ms.topic: faq
-  ms.date: 02/21/2025
+  ms.date: 12/29/2025
   ms.author: kenwith
   ms.reviewer: ashishj
   ai-usage: ai-assisted
@@ -23,10 +23,19 @@ sections:
         answer: |
             No, the following configuration items are being used by app proxy and shouldn't be altered or deleted:
             - Enable/Disable “Allow public clients flows”.
-            - CWAP_AuthSecret (Client secrets).
+            - Federated credentials.
             - API Permissions.
             Modifying any of the above configuration items on the App registration page breaks preauthentication for Microsoft Entra application proxy.
 
+      - question: |
+         An application proxy app's client secret (CWAP_AuthSecret) is nearing expiry or has already expired. What should I do?
+        answer: |
+              Application Proxy apps no longer rely on CWAP secrets. For apps using Entra ID pre-authentication, Federated Identity Credentials (FIC) are now used instead. FIC is more secure, do not expire, and require significantly less maintenance.
+              Applications configured with Passthrough pre-authentication or those using Access Tokens do not require Federated Identity Credentials — even if an FIC was previously created.
+           
+              You can safely ignore any existing CWAP secrets in the app registration of your Application Proxy app and/or clean-up old or expired secrets.
+              For more information about Federated Identity Credentials, see [Overview of federated identity credentials in Microsoft Entra ID](/graph/api/resources/federatedidentitycredentials-overview).
+
       - question: |
          Can I delete an application proxy app from the App registrations page in the Microsoft Entra admin center? 
         answer: |
@@ -103,16 +112,6 @@ sections:
         answer: |
               No, this is currently not supported.
 
-      - question: |
-         What happens if I delete CWAP_AuthSecret (the client secret) in the app registration?
-        answer: |
-              The client secret, also called *CWAP_AuthSecret*, is automatically added to the application object (app registration) when the Microsoft Entra application proxy app is created.
-          
-              The client secret is valid for one year. A new one-year client secret is automatically created before the current valid client secret expires. Three CWAP_AuthSecret client secrets are kept in the application object always. 
-          
-              > [!IMPORTANT]
-              > Deleting CWAP_AuthSecret breaks preauthentication for Microsoft Entra application proxy. Don't delete CWAP_AuthSecret.
-
       - question: |
          I'm using or want to use Microsoft Entra application proxy. Can I replace the "onmicrosoft.com" fallback domain of my tenant in Microsoft 365 as suggested in the article "Add and replace your onmicrosoft.com fallback domain in Microsoft 365"? 
         answer: |