Azure logic app api connection authentication problem

Question

I have an Azure Logic App that sends emails via Outlook using an Azure API Connection. For authentication, I use a user account and have configured a Conditional Access policy in Entra ID, setting the reauthentication period to one year. However, I am facing an issue where the API connection frequently fails with an "This connection is not authenticated." error every 1 to 3 days. When I manually reauthenticate, it works temporarily but then fails again after some time. I have tried different solutions, but nothing seems to resolve the issue. Has anyone encountered a similar problem or knows how to fix it?

Answer 1

Hello Tushar,

Thank you for posting your question in the Microsoft Q&A forum. 

As I am understanding the issue, the Logic App's Outlook API connection fails every 1–3 days with "This connection is not authenticated", despite setting a 1-year reauthentication policy in Entra ID (Azure AD) 

At the core of this issue lies Azure AD's default token expiration behavior for OAuth tokens used in API connections. While Conditional Access policies allow administrators to define session controls (such as the one-year reauthentication period you configured), these settings do not override Azure AD's native token lifetime management for service-to-service connections. Microsoft's identity platform enforces default expiration timeframes for different token types, with refresh tokens for standard OAuth flows typically valid for 90 days regardless of Conditional Access session settings.  

This creates a critical disconnect your conditional Access policy attempts to enforce a one-year session duration; however, the underlying API connection tokens expire based on Azure AD's default token lifetimes. The Logic App's connection manager treats these expired tokens as authentication failures, triggering the error message. 

 

Useful links to understand more about the root cause -

• https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app#refresh-tokens  
• https://learn.microsoft.com/en-us/entra/identity-platform/configurable-token-lifetimes  

 

You may try the steps as provided below to fix the issue: Replace user-based auth with an Azure AD App Registration (Service Principal). 

Steps: 

• Register an App in Microsoft Entra ID.
• Grant API Permissions (e.g., Mail.Send for Outlook). 
• Use Client Credentials (Client ID + Secret/Certificate) in the Logic App connection. 

Reference documentation - https://learn.microsoft.com/en-us/azure/logic-apps/authenticate-with-managed-identity?tabs=consumption  

Bonus tip - If you would like to automate reauthentication, use Azure Automation or a scheduled Logic App to refresh the token every 60 days (before expiry) - https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal#refresh-connections  

If the above answer helped, please do not forget to "Accept Answer," as this may help other community members refer to the information if they face a similar issue. Your contribution to the Microsoft Q&A community is highly appreciated.