Error from token exchange. The refresh token has expired due to inactivity

(1) Share

Report

Posted on by anthonys123

457

This error popped up when a user was trying to submit a SharePoint news post for approval.

Error from token exchange: Runtime call was blocked because connection has error status: Enabled| Error, and sharepointonline is in the block list. Connection errors: [ParameterName: token, Error: Code: Unauthorized, Message: 'Failed to refresh access token for service: sharepointonlinecertificatev2.

Error: Failed to acquire token from AAD: {"error":"invalid_grant","error_description":"AADSTS700082: The refresh token has expired due to inactivity. The token was issued on 2024-08-09T18:19:01.4148289Z and was inactive for 90.00:00:00.

I've run into token errors before but I'm confused with this one. Two users tried submitting the same article for approval and rendered the same error. When I submitted the post (as myself), it went through with no problem. I have also signed in as one of the other users and submitted a new news post without an issue.

Usually, in my experience, these errors are due to an expired token for a connector in Power Automate. I'd have to reauthorize the connection before the flow would run successfully.

Is this error indicated that the user's sign in to SharePoint had expired? I can't imagine how that could be the case. I've done nothing in Power Automate to resolve the error and yet it seems to have resolved itself.

EDIT:

I checked the errors on both of the two original submissions. It does seem like this is an authentication error for the users based on the timestamp for the token issue.

1 - The token was issued on 2024-08-02T17:14:21.4274456Z and was inactive for 90.00:00:00.

2 - The token was issued on 2024-08-09T18:19:01.4148289Z and was inactive for 90.00:00:00.

When I signed in as one user to test this, I'm signing in with a Temporary Access Pass acquired through Azure.

Should I have my users sign out, close their browser, and sign back in to resolve this error?

Categories:

Building flows

I have the same question (0)

All responses (4)

Answers (0)

Mike2500 1,247 Super User 2024 Season 1 on at

Like (0)

Report

I posted a similar question here: Token Refresh Error for some users, sometimes

You didn't say, but if the flow was being triggered from a power apps button, it's using their connection, not the connection with the flow. That would explain why the connection looks fine. It also explains why it works for some users, but fails for others. Unfortunately, that's as far as I've gotten with this issue, except that a refresh seems to fix it for my users.

If your flow is not being triggered from a power app, then I have no idea.

Was this reply helpful? Yes No
anthonys123 457 on at

Like (0)

Report

JFC you still can't easily respond to a comment in your own post.

@Mike2500 This is a News Post in SharePoint. All the user sees is [Submit for Approval] in the top right of the page - as shown here in step 6 https://windowsmanagementexperts.com/news-approval-process-sharepoint-online/

I guess it's the same as a button? The flow is being triggered but fails immediately after the trigger due to the expired refresh token.

I suggested to my users that they sign out of M365 in their browser, restart the browser, and sign back in. I believe they should get a prompt to authenticate when submitting a news post as shown in step 7 in that article.

What's weird here is that in the four years we've been doing this, this is the first time this has happened. The fact that it happened for two Principal parties at our organization on the same article adds a bit of weight to the issue.

I would think SharePoint would prompt the user to re-authenticate in real time before the trigger goes through and the workflow fails.

Was this reply helpful? Yes No
Mike2500 1,247 Super User 2024 Season 1 on at

Like (0)

Report

Yes, the flow for the news post is being triggered by the user, so it's the user's tokens that are involved, as I understand it.

But, you mentioned "two principal parties". So, they've been active in the system? Your tokens say there were issues in August, but those tokens should auto-renew as the user accesses the system (it's a sliding expiration, so as a user signs in each day, the token should get renewed with an expiration date of 90 days in the future). As I understand it, your error message is saying those users haven't signed in since august.

Was this reply helpful? Yes No
anthonys123 457 on at

Like (0)

Report

Right. Principle parties meaning one of the owners and one of the regional managers. They're definitely signed in every day.

Was this reply helpful? Yes No