## TL;DR
Entra access tokens live about an hour, and long enumerations outlast them. Pre-flight the session, checkpoint each page of users, re-authenticate on 401, and resume from the last checkpoint.

```text
agent's Entra session expired mid-run, seat enumeration failed
```

## Use this when
- An agent enumerating Entra users dies with 401 mid-run.
- The run is longer than the token lifetime.
- Short runs succeed.

## Not for this skill when
- The failure is a 429. That is throttling.
- Auth fails immediately. Fix the credential.
- The enumeration returns wrong data. That is a query problem.

## Steps
1. Validate the session with a cheap call before starting. Verify: auth is live.
2. Checkpoint each page of users durably. Verify: the checkpoint advances.
3. On 401, re-authenticate the session. Verify: the new session works.
4. Resume from the last checkpoint. Verify: enumeration continues.
5. Confirm the full user list. Verify: the count is complete.

## Variant phrasings
### Entra session expired
The short phrasing.
### 401 mid-enumeration
The status-first search.
### seat count failed
The symptom-first phrasing.

Compatibility: Microsoft Entra ID auth; any agent runtime.

## Why it happens
Access tokens are short-lived by design. Any enumeration longer than the token lifetime hits this unless it re-authenticates and resumes.

## Edge cases / pitfalls
- Refresh tokens also expiring on very long runs; the re-auth must handle that.
- Conditional access re-prompting interactively, which an agent cannot satisfy; use a compliant non-interactive flow.
- The checkpoint needing the page cursor, not just a count.
- Re-auth loops when the underlying credential is dead; cap re-auth attempts.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xMo0AkqLw7Azhe7bw_PPDA