## TL;DR
This is the operational twin of the mid-run expiry problem: the credential itself, a secret or certificate on the app, reached its end date while the agent depended on it daily. Restore access by issuing a new credential, then fix the system that let it lapse: prefer managed identity or a certificate with a tracked renewal, put the expiry date in the team renewal calendar, and add a daily check that reports days remaining so renewal becomes routine.

```text
the agent's credential expired mid-sweep and its mailbox access broke
```

## Use this when
- All mailbox access through the app stops at a specific date and time.
- The app registration shows the used credential past its end date.

## Not for this skill when
- Access was removed deliberately in a security review. Do not restore without that review reversing.
- Only Graph calls fail while another API still works with the same credential. Investigate per-service config.

## Steps
1. Confirm the expiry from the app registration and match it to the first failure time. Verify: expiry is the proven cause.
2. Issue the replacement credential, update the vault entry the agent reads, and restart the agent service. Verify: a test mailbox read succeeds.
3. Re-run the interrupted sweep from its checkpoint rather than from the start. Verify: previously processed mail is not duplicated.
4. Register the new expiry in the renewal tracker and add an automated days-remaining check with a warning threshold. Verify: the tracker and the check both show the new date.
5. Review other agent credentials in the same estate for near expiries. Verify: no other credential is inside the warning window unnoticed.

## Variant phrasings
### agent credential expired mailbox access broken rotation
The credential lapse variant.
### track app credential expiry renewal monitoring agents
The monitoring variant.

Compatibility: Microsoft Entra ID credentials and comparable service account models.

## Why it happens
Credentials expire quietly and completely. The date was knowable a year in advance, so every expiry outage is a monitoring failure, not bad luck, and estates with many agent identities need the tracker more than any single fix.

## Edge cases / pitfalls
- Overlap old and new credentials briefly during planned rotation to avoid a hard gap, then remove the old one.
- A certificate usually outlasts a secret and is harder to leak from config. Prefer it for unattended agents.
- Keep a break-glass documented path for restoring agent access, tested once, not improvised during an incident.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rTgaBXd_j1ro10u3NLBmsg