InvalidAuthenticationToken" on Azure Cost Management API calls

TL;DR

Get a fresh access token for the right tenant and the Azure management audience, then retry the call. Tokens expire (usually within an hour), and agents that cache one across runs start failing with this error. The fix is always a fresh token, never a code change.

The error

InvalidAuthenticationToken

Fix it

1. Inspect the token your agent is sending: check its expiry claim and confirm the tenant and audience match your subscription (audience must be the Azure management endpoint). Expected: you find an expired token, or a token issued for a different tenant.

2. Request a new access token for the correct tenant and audience through your normal sign-in flow (interactive login, service principal, or managed identity). Expected: a new token with a fresh expiry.

3. Replace the cached token in the agent's configuration or credential store and retry the Cost Management call. Expected: 200 with cost data.

Use this when

• Cost Management calls worked yesterday and fail today with no config change
• A long-running agent starts throwing auth errors mid-run
• You switched tenants or subscriptions and the old token is still cached

Not for this skill when

• The error is about the wrong audience on a fresh token (fix the audience the token is requested for)
• The service principal's own credential expired (that surfaces when requesting the token, not on the API call)
• The call returns 403 (the token is valid but the identity lacks cost permissions)

Variant phrasings

• Azure access token expired cost management API
• The access token is invalid Azure
• 401 InvalidAuthenticationToken Azure Management API
• refresh token for Azure Cost Management calls

Why it happens

Azure AD access tokens are short-lived by design. Agents commonly fetch one token at startup and reuse it for hours, or they cache a token from tenant A while querying resources in tenant B. The API validates expiry, tenant, and audience on every call, so any mismatch fails the same way.

Edge cases

• Clock skew on the agent's machine can make a valid token look expired; check the machine's time
• Managed identity endpoints can return tokens for the wrong audience if the resource parameter is off; set it to the management endpoint explicitly
• Do not extend token lifetime as a workaround; fix the refresh logic instead
• If failures are intermittent, look for multiple code paths each caching their own token

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_sWGG4ht4YOYl5xRaL60ZKw