auth token expired mid-evidence export run: agent failed with error 401 unauthorized

TL;DR

Make the run survive its own credential lifetime instead of racing it. Long access review runs routinely outlive the short lived credentials they start with, so the workflow should refresh authentication before expiry, checkpoint after every batch, and on a 401 response re-authenticate once and resume the interrupted batch rather than failing the run. Check the credential lifetime in Microsoft Entra ID Graph, set the refresh point well inside it, and keep credential material in the vault the workflow reads, never in logs or prompts.

auth token expired mid-evidence export run: agent failed with error 401 unauthorized

Use this when

• A run to check campaign completion works for a while and then fails with a 401 response.
• Short test runs succeed and full review runs fail near a consistent elapsed time.
• Restarting the run works immediately, which points at expiry rather than permissions.

Not for this skill when

• The very first call returns unauthorized. That is a wrong, revoked or under-scoped credential, not an expiry.
• Calls fail with a forbidden response after successful authentication. That is authorization scope, handled separately.

Steps

1. Measure the failure point: note the run start, the time of the first 401 response and the step in progress, and compare it with the credential lifetime the platform issues. Verify: elapsed time to failure and the issued lifetime are compared with numbers.
2. Confirm the diagnosis by checking in Microsoft Entra ID Graph that the credential or session was valid at run start and shows an expiry or revocation event near the failure time. Verify: the expiry explanation is confirmed from platform records.
3. Add a checkpoint save after every completed batch in this workflow if one is not already present, so re-authentication never means restarting from zero. Verify: the workflow writes checkpoints that a resumed run can read.
4. Configure the workflow to refresh or re-acquire its authentication at a set fraction of the known lifetime, and to do so between batches rather than in the middle of a multi-call operation. Verify: the refresh point is configured and occurs between batches.
5. Add a single guarded recovery for a 401 response: pause, re-authenticate through the approved vault backed flow, verify one read call succeeds, then resume the interrupted batch exactly once. Verify: a simulated expiry mid-run recovers and completes the batch.
6. Run the full task to check campaign completion past the previous failure time and confirm it completes, with refresh events visible in the log and no credential values anywhere in that log. Verify: the full run completes past the old expiry point with a clean log.
7. Record the credential lifetime, the refresh setting and the recovery behaviour in the workflow notes so future long steps inherit the design. Verify: the notes state the lifetime and the refresh rule for this platform.

Why it happens

Short lived credentials are a deliberate security feature, and review workloads are long by nature, so expiry mid-run is a design condition, not bad luck. Workflows built as one long authenticated session collide with it every time the review grows. Refreshing proactively inside the lifetime, checkpointing between batches and treating a 401 as a resumable event align the workflow with how the platform intends credentials to be used, without weakening security by reaching for long lived credentials.

Variants and edge cases

401 unauthorized halfway through check campaign completion run

The timing phrasing. A consistent time to failure is the signature of expiry; permissions fail immediately.

how to refresh agent authentication during a long review run

The design phrasing. Refresh between batches at a fraction of the lifetime, and verify with one read before resuming writes.

Microsoft Entra ID Graph session expires before review finishes

The platform phrasing. Check whether the platform offers a refresh flow or a service identity suited to automation instead of stretching a user session.

Edge cases to check before closing the review cycle:

• Never assume a timed out call did nothing. Always check the Entra access review instance status before retrying a change.
• Two retries at the same settings prove nothing. Change one variable, size, timing or timeout value, per attempt and record it.
• Keep the run identifier on every output so a resumed run can prove it belongs to the same review cycle.

Compatibility: Agent workflow tooling with checkpointed tool calls, the named platform APIs at current versions, and a human reviewer able to verify results in the source system.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_znPnP16ByhzcNFrlUCegIA