Flow Connections error due to Credential Expiration

[chanakya]

Hello All,

We are having an issue with credentials expiring in Microsoft Flow Connections.

The connections seem to expire every 2 weeks disrupting the Flow associated with it.

The flows in question are set to run daily and work as expected, but break down after 14 days due to authentication issues
and users are required to reenter their credentials.

Error Message:
"Invalid JWT Token. The token is expired."

Is there a way to ensure that the flow connections do not break ?

Thanks.

[TravisB]

Hi @chanakya,

Can you please post the url of the flow edit page for the particular flow you're having issue with?

Also what is the service associated with the expiring connection (outlook, facebook, etc)?

Thanks,

Travis

[chanakya]

Hi Travis,

   Thanks for reaching out.

The connections are using following services:

"SharePoint" and "Office 365 Outlook"

[TravisB]

Hi @chanakya,

This is strange. Those are both Microsoft services so we should be able to refresh these connections indefinitely for you.

Can you please post the url of the edit flow page for the affected flow? This will let me identify the logs for your specific connection.

Thanks,

Travis

[chanakya]

Hi Travis,

Here are a couple of urls:

https://flow.microsoft.com/manage/environments/Default-5c95da56-0d5c-4dbc-b531-065cebf5abcc/flows/sh...

https://flow.microsoft.com/manage/environments/Default-5c95da56-0d5c-4dbc-b531-065cebf5abcc/flows/sh...

Also, we have MFA enabled in our environment.

Let me know if any more information is needed.

Thank You.

[TravisB]

Hi @chanakya,

We dug into the logs and can see that we are failing to refresh your connections with an error having to do with MFA.

This is unusual since if you created the connection while signed in with MFA, we should be able to refresh the connection indefinitely.

The running theory is that your admins may have done something in the background that is affecting the refresh requirements so our attempts to refresh fail.

I'm going to private message you an email alias. If you can get your tenant admin to write to that alias, we can go through with them to try and figure out what they're doing that's affecting your connections.

Best,

Travis

[TravisB · Accepted solution]

Wanted to post the conclusion of this thread in case anyone happens to run into the same issue.

It looks like this tenant had instituted an MFA expiration policy of 14 days that is preventing us from refreshing their users' connections. This may be opted into by default when instituting MFA for your tenant - so that's something to consider.

For more information about these expiration rules, documentation can be found here:
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-configurable-token-lifetime...

Best,

Travis

[Anonymous]

Hi TravisB,

I am facing a similar issue. I have a custom-solution built using Microsoft SharePoint Lists and Microsoft Flow.

When an item is created on List A, I have designed a Flow to create an item on List B. 

The flows worked smoothly until yesterday which was when MFA was enabled by our admins for logging in to O365.

After reading this thread,  I refreshed my connections (SharePoint) in Microsoft Flow which has now triggered the flows again.

Now, I am not sure if they will keep running indefinitely or will need a connection refresh regularly for them to keep running?

Is there any way to know this? Can this be avoided/resolved?

[TravisB]

Hi @Anonymous,

Referencing the documentation above, it looks like the default setting for MFA refresh tokens is to be renewed indefinitely.

So unless your tenant has specifically decided otherwise, there shouldn't be any issues out of the box.

If your tenant has configured a shorter lifetime, the documentation above also outlines methods for specifiying a policy specifically for Flow that supercedes the default setting.

Thanks,

Travis

[NieGreJoh]

Hi 

Have any of you tried to "whitelist" the endpoint of flow??

Check https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats...

Check also my recording of how to  https://blog.hexatown.com/trusting-my-own-ip-range-bdcca10b9f37

[DougL]

The default most definitely is not "renew indefinitely". We're running into the same exact issue with MFA, and we never tampered with any of the default values.

There really should be a way to use a stored app password with this rather than a refresh token. That's the standard way to handle MFA from service accounts.

[Poidah]

Agreed. There should be a way of enabling MFA without killing ALL of your Flows. This sounds like what the Secure Store service would be used for. What is its equivalent in Office 365? This paragraph describes the ability to set the Refresh Token Lifetime to *until-revoked* using a policy... Is this the only way forward? https://docs.microsoft.com/en-us/azure/active-directory/active-directory-configurable-token-lifetime...

[Anonymous]

https://web.powerapps.com/environments/Default-f66fae02-5d36-495b-bfe0-78a6ff9f8e6e/logicflows

[PeterSelchDahl]

This solution should work for customers that use Microsoft Flow and service accounts for running the flow: https://blog.peterdahl.net/2018/01/09/microsoft-flow-and-azure-conditional-access-azure-mfa/

I still need feedback from Microsoft around a solution that will work for end-users.

/Peter Selch Dahl

[Anonymous]

I've brought this solution to the attention of our IT Team, but low hopes they will allow this workaround of whitelisting certain IP's.

Hopefully Microsoft can come up with an more user-friendly approach so users arent having to get exceptions done by their IT Administrators.