cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
Mike2500
Level 8

Trying to better understand authentication and token lifetime

UserA creates simple flow that connects to Office 365 Outlook and SharePoint Online. Given that userA has to change their password every 90 days:

 

  • Will the Flow continue to function indefinately, even after the password changes?
  • Does the above answer change if the flow isn't used for a period of time?
  • Does MFA impact any of this?
  • What are the possible causes of connections with a status of "can't sign in, update password"

 

 

8 REPLIES 8
Community Support Team
Community Support Team

Re: Trying to better understand authentication and token lifetime

Hi @Mike2500,

 

For first question, if the password changes, a connection for flow will continue to function until the token expires. If the token expires, the user need to update their password for the flow to continue function.

For second question, if the time is not more than expire time, the flow will continue to function indefinitely.

For third question, yes, the MFA makes impact on this.

For forth question, the possible causes as below:

  • The user has changed password of the account.
  • The user has delete the connection in Microsoft Flow
  • You have created the connection, but you don’t provide an authentication for it.

 

More details about the token lifetime, please check the following document:

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-configurable-token-lifetime...

 

More details about the MAF policy, please check the following document:

https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-how-i...

 

 

 

Best regards,

Kris

Community Support Team _ Kris Dai
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Mike2500
Level 8

Re: Trying to better understand authentication and token lifetime

So, the connection will continue to function until the token expires. If the flow runs every day, then every day it is using its refresh token to get another access token. Since the default value of "Single-Factor Refresh Token Max Age" is "Until-revoked", and since the refresh token "will not be revoked on voluntary password resets", then the connection will continue to function indefinately? Or, if the flow sits for 90 days without running, then the refresh token will expire, and the connection will fail (90 days being the default value for "refresh token max inactive time"). Or, if the user's password expires, then the refresh token will be revoked, and the connection will fail.

 

I'm not sure what you meant by "yes, the MFA makes impact on this". Could you please clarify the impact of MFA?

You mentioned that the connection will fail if the user changes their password, though the token doc said that refresh tokens will not be revoked for voluntary password resets. Could you please clarify?

 

 

Super User
Super User

Re: Trying to better understand authentication and token lifetime

Hi @Mike2500 have you received some answer to aditional questions you asked? Or did you find answer by yourself?
Hope @v-xida-msft have some answers.

P.
Mike2500
Level 8

Re: Trying to better understand authentication and token lifetime

Sorry, no new info.

Super User
Super User

Re: Trying to better understand authentication and token lifetime

Is there any update regarding this topic? I am still looking for some answer to this 90 day lifetime.
Highlighted
Toasteroven
Level: Powered On

Re: Trying to better understand authentication and token lifetime

BUMP.

 

I have a flow that runs when a user presses a button in a PowerApp, however after 90 days of not using the app they get an Unauthorised error due to the access token being revoked. I then have to manually re-add the connection.

 

Would really like some insight from staff into OPs follow up question

Super User
Super User

Re: Trying to better understand authentication and token lifetime

Hello @Toasteroven, I still had no chance to find out how to solve this except I am using for all Flows service account. Just one service account that is refreshing its connection each time it runs.

But if you have only few Flows, you are still in riskt that token will expire.

P.

Toasteroven
Level: Powered On

Re: Trying to better understand authentication and token lifetime

I have one flow, but about 30 users that use it. If any one of them doesn't use it for 90 days, their access token is revoked and they can no longer use it until I manually re-add their connection.

 

I am looking at setting the expiry time of tokens from 90 days to indefinite. Are there any security concerns with doing this?

Helpful resources

Announcements
firstImage

Power Platform Online Conference

Join us for the first ever Power Platform Online Conference!

firstImage

Incoming: New and improved badges!

Look out for new contribution recognition badges coming SOON!

firstImage

New & Improved Power Automate Community Cookbook

We've updated and improved the layout and uploading format of the Power Automate Cookbook!

thirdimage

Power Automate Community User Group Member Badge

Fill out a quick form to claim your user group badge now!

sixthImage

Power Platform World Tour

Find out where you can attend!

seventhimage

Webinars & Video Gallery

Watch & learn from the Power Automate Community Video Gallery!

Users online (5,456)