agent's Entra session expired mid-run, seat enumeration failed
Keeps agents enumerating Entra seats alive across session expiry by pre-flighting the session, checkpointing each page, and re-authenticating on 401. Use when seat enumeration dies mid-run on expired sessions. Not for Graph throttling.
TL;DR
Entra access tokens live about an hour, and long enumerations outlast them. Pre-flight the session, checkpoint each page of users, re-authenticate on 401, and resume from the last checkpoint.
agent's Entra session expired mid-run, seat enumeration failedUse this when
- An agent enumerating Entra users dies with 401 mid-run.
- The run is longer than the token lifetime.
- Short runs succeed.
Not for this skill when
- The failure is a 429. That is throttling.
- Auth fails immediately. Fix the credential.
- The enumeration returns wrong data. That is a query problem.
Steps
- Validate the session with a cheap call before starting. Verify: auth is live.
- Checkpoint each page of users durably. Verify: the checkpoint advances.
- On 401, re-authenticate the session. Verify: the new session works.
- Resume from the last checkpoint. Verify: enumeration continues.
- Confirm the full user list. Verify: the count is complete.
Variant phrasings
Entra session expired
The short phrasing.
401 mid-enumeration
The status-first search.
seat count failed
The symptom-first phrasing.
Compatibility: Microsoft Entra ID auth; any agent runtime.
Why it happens
Access tokens are short-lived by design. Any enumeration longer than the token lifetime hits this unless it re-authenticates and resumes.
Edge cases / pitfalls
- Refresh tokens also expiring on very long runs; the re-auth must handle that.
- Conditional access re-prompting interactively, which an agent cannot satisfy; use a compliant non-interactive flow.
- The checkpoint needing the page cursor, not just a count.
- Re-auth loops when the underlying credential is dead; cap re-auth attempts.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstxMo0AkqLw7Azhe7bwPPDA