Structured Incident Report — Passthrough Token Validation Failure (Azure Portal / MSAL)

Question

Dear Team,

Please be aware:

Date: 19 September 2026

Location: Romania

System: Azure Portal (Version 18.248.0.1)

Session IDs Observed:

a62bb19736fb4c4aa0fe537017ed681d

Aa34a3a1864f4cf8ae08964194ac0c36

Hey Lalima, Azure Portal failed to validate authentication tokens during resource provider calls. The portal attempted to use passthrough tokens lacking required resource provider (RP) context, resulting in repeated 401 Invalid Token responses.

This is an admin prank? The failure is reproducible across sessions and timestamps.

2. Evidence Extracted From Logs

2.1 Key Error Messages

From the uploaded logs:

“Token validation failed. A passthrough token was detected without proper resource provider context” “error="invalid_token", error_description="Passthrough token detected but secure validation specified at resource provider context."”

These lines appear in both incidents (09:44 and 09:52), confirming a persistent issue.

HTTP Response Details

Status: 401 Unauthorized

Error Code: PassthroughTokenValidationFailed

Failure Cause: gateway

Correlation IDs:

• 3b40673c-183e-4e23-a398-caedae707de5
• 7a480065-bf67-49a4-b054-e870e8170d6e

Portal Modules Involved

msal-browser-1p-v513.js

MsPortalFx.Base.Diagnostics.ErrorReporter

KavaJfv2fdrz.js

1i5xRkbowapb.js

These modules handle token acquisition, validation, and RP communication.

Technical Root Cause

The Azure Portal attempted to forward a passthrough token to backend resource providers (ARM, RBAC, Storage, Compute). The token did not contain the required RP context, causing the backend to reject it.

Based on the logs and typical MSAL behavior, the failure is caused by one or more of the following:

Stale or corrupted MSAL tokens

Tenant issuing legacy ARM tokens (common in system tenants)

Missing or misconfigured resource provider registrations

Conditional Access or token lifetime policies interfering

Cross‑tenant contamination (logging into multiple directories)

Portal unable to acquire a modern ARM token for this tenant

Could you please investigate and advise?

Kind Regards,

H4d0