Hello, I think you are my last hope.
I got a PowerApps app using multiples flows. Both the app and the flows were built by a service provider, which we end to cooperate meanwhile - for a big part due to this issue. The application is stored on an internal service account, with powerapps premium licence, which used to have MFA activated prior to Microsoft enforced rules.
One of the flow regularly (up to 2/10) ends with following error, since the beginning. When it does, it is ALWAYS in 2 particular spots of the flow :
The error is the following, in both cases (I replaced the office365users id from source by a *, maybe there's a way to identify me) :
{
"status": 401,
"source": "https://europe-002.token.azure-apim.net:443/tokens/europe-002/office365users/*/exchange",
"message": "Error from token exchange: Runtime call was blocked because connection has error status: Enabled| Error, and office365users is in the block list. Connection errors: [ParameterName: token, Error: Code: Unauthorized, Message: 'Failed to refresh access token for service: office365usercertificate. Correlation Id=916427d6-b7cf-41fa-a726-75e034947e32, UTC TimeStamp=11/21/2024 10:51:42 AM, Error: Failed to acquire token from AAD: {\"error\":\"invalid_grant\",\"error_description\":\"AADSTS700082: The refresh token has expired due to inactivity. The token was issued on 2024-06-28T21:07:26.5536738Z and was inactive for 90.00:00:00. Trace ID: 177795df-5f06-4414-bc32-10f550c70b00 Correlation ID: 4e34e3f6-6607-46e9-ba65-5a6bb03dd8d7 Timestamp: 2024-11-21 10:51:42Z\",\"error_codes\":[700082],\"timestamp\":\"2024-11-21 10:51:42Z\",\"trace_id\":\"177795df-5f06-4414-bc32-10f550c70b00\",\"correlation_id\":\"4e34e3f6-6607-46e9-ba65-5a6bb03dd8d7\",\"error_uri\":\"https://login.windows.net/error?code=700082\"}']"
}
From what I understand from my own readings, such issue can happen from :
- the account is using MFA;
- the application connections are broken;
The account USED TO have MFA activated - but doesn't have anymore (Entra account infos for that account, showing no effective MFA stuff) :
The applications connexions don't seem broken aswell (they were doubled for no specific reason by the service provider) :
I read more about the refresh tokens and our issues, and it looks like :
- we hit a boundary of 90 days, which is the regular lifetime expectancy of a refresh token
- the connexion seems to use old refresh tokens, but most of time it doesn't
- the old refresh tokens seem to never refresh - I suppose when you got such mechanism, deprecated tokens are supposed to be DELETED and replaced with new ? not simply stacking in the pool ?
- there is only one try and it instantly fails the flow if the token is invalid
- the service account got a pool of refresh tokens, and we got multiple old refresh tokens running (since date of refresh token is sometimes different, I counted at least 4 differents dates, and sometimes it's the same)
We're stucked with that issue since few months, and I'm currently working on that matter with a Microsoft tech since almost 2 months - with 0 special progress whatsoever.
Do you ppl would have any sort of idea to unblock this situation ? Wasted time on that matter is incredible for such "basic" thing which would work flawlessly due to the very basic needs of getting a connection for almost anything.
Optional questions :
- Is there a way to DELETE/REFRESH refresh tokens out of an account ? If following command is supposed to work
Revoke-AzureADUserAllRefreshToken (AzureAD) | Microsoft Learn, what are the downfalls using it ? How will my application act after running it (actual waiting flows, notably - but will it generate new refresh tokens aswell ?) The application is in production.
- Is there a way to see actual pool of refresh tokens out of an account ?
I would like to use my work time better checking if a flow failed, launching it manually back - seeing it failing again and calling the victim to tell to redo his request... To *eventually* get another fail.
Ty for any type of answer.
