M365 Copilot Plugin authentication token keeps timing out

Question

We have our plugin created and working, however we have been noticing authentication issues about expiration of the token:

This message appears after 1 hour of authenticating (assuming default time) shouldn't the refresh token be kicking in?

Answer 1

Hi Luis,

An access token expiring around 1 hour is expected behavior in OAuth. Normally, a refresh token should be used to silently obtain a new access token without requiring re-authentication.
https://docs.azure.cn/en-us/entra/identity-platform/refresh-tokens

If that’s not happening, it usually means one of the following:

• A refresh token isn’t being issued.
• The client isn’t properly storing or using the refresh token.
• Entra ID policies (e.g., Conditional Access) are forcing re-authentication.

Copilot plugins support OAuth 2.0 authorization code flow, so the refresh flow should work if implemented correctly.
https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/plugin-authentication

I’d recommend confirming that a refresh token is returned and that your app is actually using it during token renewal. It may also help to review Microsoft Entra sign-in logs and Conditional Access policies to rule out policy-driven re-authentication.

Regards,
Burak V.