Flow Connections error due to Credential Expiration

(0) Share

Report

Posted on by chanakya

Hello All,

We are having an issue with credentials expiring in Microsoft Flow Connections.

The connections seem to expire every 2 weeks disrupting the Flow associated with it.

The flows in question are set to run daily and work as expected, but break down after 14 days due to authentication issues
and users are required to reenter their credentials.

Error Message:
"Invalid JWT Token. The token is expired."

Is there a way to ensure that the flow connections do not break ?

Thanks.

Categories:

General topics

All responses (14)

Answers (1)

Sort by

TravisB Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @chanakya,

Can you please post the url of the flow edit page for the particular flow you're having issue with?

Also what is the service associated with the expiring connection (outlook, facebook, etc)?

Thanks,
Travis
chanakya 4 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi Travis,

Thanks for reaching out.

The connections are using following services:
"SharePoint" and "Office 365 Outlook"
TravisB Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @chanakya,

This is strange. Those are both Microsoft services so we should be able to refresh these connections indefinitely for you.

Can you please post the url of the edit flow page for the affected flow? This will let me identify the logs for your specific connection.

Thanks,
Travis
chanakya 4 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi Travis,

Here are a couple of urls:

https://flow.microsoft.com/manage/environments/Default-5c95da56-0d5c-4dbc-b531-065cebf5abcc/flows/shared/c7901429-402d-4c54-9359-6842fc77d785?backUrl=%2Fflows%2Fshared%2Fc7901429-402d-4c54-9359-6842fc77d785%2Fdetails

https://flow.microsoft.com/manage/environments/Default-5c95da56-0d5c-4dbc-b531-065cebf5abcc/flows/shared/fc72dc99-9d3b-4999-a5e9-5d5500cac99b?backUrl=%2Fflows%2Fshared%2Ffc72dc99-9d3b-4999-a5e9-5d5500cac99b%2Fdetails

Also, we have MFA enabled in our environment.

Let me know if any more information is needed.

Thank You.
TravisB Microsoft Employee on at

Like
a
(1)

Report
Copy link

Link copied!

Hi @chanakya,

We dug into the logs and can see that we are failing to refresh your connections with an error having to do with MFA.

This is unusual since if you created the connection while signed in with MFA, we should be able to refresh the connection indefinitely.

The running theory is that your admins may have done something in the background that is affecting the refresh requirements so our attempts to refresh fail.

I'm going to private message you an email alias. If you can get your tenant admin to write to that alias, we can go through with them to try and figure out what they're doing that's affecting your connections.

Best,
Travis
Verified answer

TravisB Microsoft Employee on at

Like
a
(2)

Report
Copy link

Link copied!

Wanted to post the conclusion of this thread in case anyone happens to run into the same issue.

It looks like this tenant had instituted an MFA expiration policy of 14 days that is preventing us from refreshing their users' connections. This may be opted into by default when instituting MFA for your tenant - so that's something to consider.

For more information about these expiration rules, documentation can be found here:
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-configurable-token-lifetimes

Best,
Travis
Community Power Pla... Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

Hi TravisB,

I am facing a similar issue. I have a custom-solution built using Microsoft SharePoint Lists and Microsoft Flow.

When an item is created on List A, I have designed a Flow to create an item on List B.

The flows worked smoothly until yesterday which was when MFA was enabled by our admins for logging in to O365.
After reading this thread, I refreshed my connections (SharePoint) in Microsoft Flow which has now triggered the flows again.

Now, I am not sure if they will keep running indefinitely or will need a connection refresh regularly for them to keep running?
Is there any way to know this? Can this be avoided/resolved?
TravisB Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @Anonymous,

Referencing the documentation above, it looks like the default setting for MFA refresh tokens is to be renewed indefinitely.

So unless your tenant has specifically decided otherwise, there shouldn't be any issues out of the box.

If your tenant has configured a shorter lifetime, the documentation above also outlines methods for specifiying a policy specifically for Flow that supercedes the default setting.

Thanks,
Travis
NieGreJoh 23 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi

Have any of you tried to "whitelist" the endpoint of flow??

Check https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next#trusted-ips

Check also my recording of how to https://blog.hexatown.com/trusting-my-own-ip-range-bdcca10b9f37
DougL 54 on at

Like
a
(1)

Report
Copy link

Link copied!

The default most definitely is not "renew indefinitely". We're running into the same exact issue with MFA, and we never tampered with any of the default values.

There really should be a way to use a stored app password with this rather than a refresh token. That's the standard way to handle MFA from service accounts.