“Token Expired” – Troubleshooting and Resolution Guide

Overview

A “Token Expired” error occurs when an authentication token used for logging in to Microsoft 365, SharePoint, ADFS, or other services has reached its expiration time. Tokens are essential for maintaining secure user sessions without requiring repeated logins.

When a token expires, the user is usually prompted to log in again, but in some cases, persistent expiration issues can disrupt access and require troubleshooting.

Common Causes of Token Expiry Errors

✔ Session timeout exceeded – User remained inactive for too long.
✔ Short token lifetime policies – Organization enforces frequent re-authentication.
✔ ADFS or Azure AD token misconfiguration – Incorrect token expiration settings.
✔ Clock synchronization issues – System time mismatch between client and server.
✔ Multi-Factor Authentication (MFA) conflicts – MFA tokens expiring too soon.
✔ Cached credentials causing authentication failures.
✔ Persistent session cookies expired.
✔ Security policies forcing re-authentication.

Step 1: Log Out and Log In Again

If the issue is caused by a simple session expiration, logging out and back in can refresh the token.

How to Log Out and Log Back In:

Open your web browser and go to the login portal.
Click on your profile icon and select Sign out.
Clear the browser cache and cookies:
- Google Chrome: Settings > Privacy & Security > Clear Browsing Data
- Microsoft Edge: Settings > Privacy > Clear Browsing History
- Firefox: Options > Privacy & Security > Clear Data
Close all browser windows.
Reopen the browser and log in again.

If the error persists, continue to the next steps.

Step 2: Clear Cached Credentials

Sometimes, stored authentication tokens in your device cause issues.

How to Clear Cached Credentials on Windows:

Open Windows Credential Manager:
- Press Windows + R, type control /name Microsoft.CredentialManager, and hit Enter.
Under Windows Credentials, find any credentials related to:
- Microsoft Office
- ADFS
- SharePoint
- Azure AD
Click Remove to delete old credentials.
Restart your device and log in again.

If you are using a mobile device, sign out and remove any stored passwords.

Step 3: Verify ADFS or Azure AD Token Lifetime Settings

The expiration of authentication tokens depends on configurations in ADFS or Azure AD.

How to Check Token Lifetime in Azure AD:

Open PowerShell as Administrator.
Connect to Microsoft 365: Connect-MsolService
Check token lifetime policies: Get-MsolPolicy
If the session timeout is too short, increase the token lifetime.

How to Extend Token Lifetime in Azure AD:

Open PowerShell and run: New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"8:00:00"}}') -DisplayName "ExtendedTokenPolicy" -Type "TokenLifetimePolicy"
Apply the new policy: Add-AzureADServicePrincipalPolicy -Id <ServicePrincipalId> -RefObjectId <PolicyId>
Restart the authentication service.

Step 4: Check ADFS Token Lifetime and Update If Necessary

For organizations using ADFS, token lifetimes can be configured.

How to Check ADFS Token Lifetime:

Open PowerShell on the ADFS server.
Run the following command: Get-AdfsRelyingPartyTrust | Select-Object Name, TokenLifetime
The default token lifetime is 60 minutes. If this is too short, extend it.

How to Increase Token Lifetime in ADFS:

Run the following command: Set-AdfsRelyingPartyTrust -TargetName "Microsoft Office 365" -TokenLifetime 480 (This sets the token lifetime to 8 hours).
Restart ADFS: Restart-Service adfssrv

Step 5: Ensure System Time Synchronization

A time mismatch between your system, ADFS, and Azure AD can cause tokens to expire prematurely.

How to Sync System Time (Windows):

Open Command Prompt as Administrator.
Run the following command: w32tm /resync
Verify the time zone: tzutil /g
If the time is incorrect, update it via Control Panel → Date & Time.

How to Sync ADFS Server Time:

Open PowerShell on the ADFS server.
Run: w32tm /config /manualpeerlist:"time.windows.com" /syncfromflags:manual /update
Restart the Windows Time Service: net stop w32time && net start w32time

Step 6: Check Conditional Access Policies in Azure AD

Conditional Access Policies may enforce strict re-authentication settings.

How to Check Conditional Access Policies:

Log into Azure AD Admin Center.
Navigate to Security → Conditional Access.
Look for policies that enforce session expiration.
If necessary, adjust policies to allow longer authentication sessions.

Step 7: Check Browser and Device Trust Policies

Some organizations require devices to be trusted before maintaining authentication sessions.

How to Check Device Compliance in Intune:

Log into Microsoft Endpoint Manager: https://endpoint.microsoft.com.
Go to Devices → Compliance Policies.
Check if your device is marked as compliant.

If your device is not compliant, it may be forced to reauthenticate frequently.

Step 8: Contact IT Support or Microsoft Support

If you continue to experience frequent token expiration, report the issue to your IT team or Microsoft Support.

Information to Provide to IT Support:

✔ The exact error message received.
✔ Steps you have already tried.
✔ The last time authentication worked correctly.
✔ Any recent changes to policies or configurations.

“Token expired” – The authentication token has expired, and the user needs to log in again.