DefaultAzureCredential error: "The refresh token has expired due to inactivity."

Markus Radszuweit 70 Reputation points
2024-07-17T14:03:54.1333333+00:00

I run some Python code on my local machine that accesses Azure resources. For authentication I have

`credential = DefaultAzureCredential(additionally_allowed_tenants=['*'])`

key_client = SecretClient(vault_url=DEFAULT_VAULT_URI,credential=credential)

This always worked until recently when at the 2nd line the script failed with error:

DefaultAzureCredential failed to retrieve a token from the included credentials.

Attempted credentials:

    *EnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.*

Visit https://aka.ms/azsdk/python/identity/environmentcredential/troubleshoot to troubleshoot.this issue.

    *ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint.*

    *SharedTokenCacheCredential: Azure Active Directory error '(invalid_grant) AADSTS700082: The refresh token has expired due to inactivity. The token was issued on 2024-04-05T06:54:24.3714715Z and was inactive for 90.00:00:00.*

I am logged in via Connect-AzAccount in Power Shell. So authentication should work by the SharedTokenCacheCredential. From the error message I get that the refresh token has expired and should be renewed.

A found a lot about this issue on the internet, e.g. https://learn.microsoft.com/en-us/answers/questions/1179223/trying-to-access-key-vault-secrets-through-python

None of the solutions worked for me: Disconnect-AzAccount and reconnect, Clear-AzContext -Force and deleting the powershell TokenCache file. Still the error persists. I am missing something here.

Does anybody have an idea ?

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,494 questions
{count} votes