## TL;DR
App credentials expire on a schedule everyone forgets: a secret created for a year dies mid-campaign, and the run fails with auth errors that look like permission loss. Check the credential expiry on the app registration, replace secrets with certificates or managed identity where the platform allows, store the new credential in the vault the agent actually reads, and add an expiry check at run start so the next expiry is a warning, not an outage.

```text
agent couldn't read the shared mailbox after the service principal token expired mid-run; delegated auth failed
```

## Use this when
- Agent mailbox reads fail mid-run with auth errors after working earlier.
- The app registration shows a secret or certificate past its end date.

## Not for this skill when
- An admin revoked the app permissions deliberately. Do not re-grant without the security review.
- Access fails for one mailbox only. That is mailbox-level permission, not the app credential.

## Steps
1. Confirm the failure time against the credential end date on the app registration. Verify: expiry, not revocation, matches the timeline.
2. Inventory every place the old credential is stored: vault entry, agent config and any cached copy. Verify: all copies are listed before rotation.
3. Create the replacement credential, preferring a certificate or managed identity, and update the vault first, then restart the agent so it picks up the new value. Verify: the agent authenticates with the new credential in a test call.
4. Grant or re-consent the app permissions if the new credential model requires it, keeping scopes to the mailboxes the agent needs. Verify: a shared mailbox read succeeds through the agent path.
5. Add a run-start credential lifetime check that warns when fewer than 30 days remain. Verify: the check reports the new credential horizon correctly.

## Variant phrasings
### service principal secret expired agent mailbox access
The expired secret variant.
### app credential rotation managed identity mail triage
The rotation variant.

Compatibility: Microsoft Entra ID app registrations, secrets, certificates and managed identities with Graph mail access.

## Why it happens
Human admins feel credential expiry through calendar reminders and consoles. An unattended agent feels it as a silent total failure at 3 AM, because nothing in the run path surfaces an approaching end date.

## Edge cases / pitfalls
- Application permissions for mail are tenant-wide unless scoped with application access policies. Scope the agent to its triage mailboxes.
- Two overlapping credentials during rotation prevent a hard cutover gap. Remove the old one after the new one is proven.
- Record credential expiry in the same tracker as domain and certificate renewals so one review catches all.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_t-EwTd86LSTYqMYeCcyc-Q