User Authentication with Microsoft Entra ID fails with Workspace ONE error "Workspace ONE Access encountered an error".

Products

• VMware vCenter Server

Issue/Introduction

• Users authenticating to vCenter Server using Identity Provider Entra ID receive a Workspace ONE error "Workspace ONE Access encountered an error."

• In vCenter Server /var/log/vmware/trustmanagement/trustmanagement-svcs.log may see the following;
  
  2026-06-29T10:32:26.274-04:00 [ws1bTLSCertExpiryCheckerScheduler-1 [] WARN  com.vmware.vcenter.trustmanagement.authbroker.IdentityProviderSSLTrustExpiryChecker  opId=] Unable to fetch idp info for tenant CUSTOMER, skipping check
2026-06-29T10:40:10.896-04:00 [tomcat-exec-27 [] INFO  com.vmware.vcenter.trustmanagement.authbroker.BrokerClient  opId=] API request GET_CLIENT_CREDENTIALS_TOKEN to url http://localhost:1080/external-vecs/http1/<vc-hostname>/443/acs/t/customer/token returned unexpected response code 401 and the following error information: {"error":"invalid_client","error_description":"oauth2.authorization.credentials.invalid"}
2026-06-29T10:40:10.896-04:00 [tomcat-exec-27 [] ERROR com.vmware.vcenter.trustmanagement.authbroker.BrokerClient  opId=] Failed to get a access token on host <vc-hostname> for tenant customer
2026-06-29T10:40:10.897-04:00 [tomcat-exec-27 [] ERROR com.vmware.vcenter.trustmanagement.vapi.impl.AuthBrokerProvidersProviderImpl  opId=] Error retrieving Auth broker identity provider list: Failed to get a access token on host <vc-hostname> for tenant customer
com.vmware.vcenter.trustmanagement.authbroker.BrokerException: Failed to get a access token on host <vc-hostname> for tenant customer
  
  
• In vCenter Server /var/log/vmware/envoy/envoy-access.log will see the tenant_admin_client being deleted. 
  
  22127:2026-03-12T15:46:25.412Z info envoy[1975] [Originator@6876 sub=Default] 2026-03-12T15:46:21.934Z DELETE /acs/t/CUSTOMER/broker/oauth2-clients/tenant_admin_client 204 via_upstream - 0 0 - 86 86 0 [Client IP]:65190 HTTP/1.1 TLSv1.2 [vCenter IP]:443 127.0.0.1:55916 HTTP/1.1 - 127.0.0.1:10114 - -

Environment

VMware vCenter Server

Cause

The tenant_admin_client credentials stored by the HVC service were deleted via a PowerCLI command, causing all operations involving this Identity Provider to fail.

Resolution

To clear this state it is necessary to reset the Identity Provider and recreate it. This reset can be accomplished with the reset_ws1.sh script attached to this KB and the steps below. 

Steps to execute script:

1. Required - Take a snapshot of the problematic vCenter VM. See Snapshot Best practices for vCenter Server Virtual Machines.
2. SSH to vCenter as root.
3. Copy the script to vCenter (i.e. WinSCP).
4. Make the script executable: chmod +x reset_ws1.sh
5. Stop the ws1a-broker service: service-control --stop vc-ws1a-broker
6. Execute the script: ./reset_ws1.sh "[email protected]" "<SSO admin Password>"  
7. Wait for 5 minutes.
8. Re-configure the Identity Provider again and verify the functionality. 

Additional Information

Configuring Microsoft Entra ID for vCenter Server