Microsoft refresh token revoked: restore the grant without losing recovery context

Define the decision

Access tokens expire normally, while refresh authorization can also become invalid or be revoked. A background job cannot repair every such event silently. The specific identity-platform response determines whether interactive authorization is required.

Work through the procedure

1. Preserve the sanitized token-refresh error and affected time window.
2. Check for intentional access revocation or administrator policy changes.
3. Reconnect the intended mailbox through the approved Microsoft flow.
4. Test sending and receiving, then inspect missed replies and queued campaign work.

Worked example

The following is a synthetic example for this procedure, not a customer result or performance benchmark.

Previously connected mailbox
Refresh request now rejected
Approved action: interactive reauthorization of the same account
Recovery gate: controlled send-and-reply succeeds and pending work has been reviewed

Read the result

The reconnection should not erase the incident history. Some replies may have arrived during the outage, and uncertain sending attempts need their own evidence before a retry.

Check before moving on

1. Confirm the account and tenant after reauthorization.
2. Keep refresh tokens out of diagnostic logs and screenshots.

Limits and next action

If revocation was intentional, obtain the account owner’s approved recovery decision through the organization’s process. Token lifetimes are not a reliable promise of uninterrupted access.

Source: Microsoft: refresh-token lifecycle