Logic app fails to connect to Azure VM citing expired token, but the connection in Config is shown as OK

Question

Logic app fails to connect to Azure VM citing expired token, but the connection in Config is shown as OK

Sergey Borovoy 541

Hi, my Logic App that starts a VM each morning is now failing to do so. It starts but can't connect to the VM:

{ "error": { "code": "ExpiredAuthenticationToken", "message": "The access token expiry UTC time '4/19/2025 4:27:06 AM' is earlier than current UTC time '4/22/2025 3:00:01 AM'." } }

But when I go to the Logic App's configuration -> Authentication, it shows the "azurevm" connection as "Connected":
User's image

What should I do? Thanks!

Accepted answer

0 additional answers

Your answer

Answer 1

Sai Prabhu Naveen Parimi 1,255 Microsoft External Staff

@Sergey Borovoy

Thanks for reaching out.

The error you're encountering — "ExpiredAuthenticationToken" — typically indicates that the access token used by the Logic App to connect to the VM has expired. While the connection shows as "Connected" in the portal, this status reflects the last successful authentication and does not necessarily indicate that the authentication token is still valid.

To resolve this, you can refresh the token by re-authenticating the connection :

Go to the Logic App’s Connections.
Click on the azurevm connection.
Select Edit API Connection and sign in again.
Save the connection.

This should update the token and allow the Logic App to run successfully.

Sai Prabhu Naveen Parimi 1,255 Reputation points Microsoft External Staff

2025-04-23T06:10:54.8766667+00:00

@Sergey Borovoy

Just checking in to see if the issue with the Logic App connecting to the VM has been resolved, or if you're still experiencing the error.

Let me know if you need any further assistance—happy to help
Sergey Borovoy 541 Reputation points

2025-04-23T08:00:36.6266667+00:00

Hello Sai Prabhu Naveen Parimi, and thanks a lot for your reply.

Yes, this was my initial idea but my problem was that the connection, as shown on the screenshot above, was not clickable.

But your reply gave me the idea to go to the Logic App -> Developer Tools -> API connection -> General, and there I finally saw that "Edit API connection". Thanks a lot!

Interestingly, there is this documentation article that says that Logic Apps are supposed to refresh the tokens automatically: https://learn.microsoft.com/en-us/power-apps/maker/canvas-apps/working-with-tokens?source=recommendations#refresh-tokens-in-power-apps-logic-apps-and-power-automate I am wondering why this did not happen in my case.

Do you perhaps know how to deal with this in the future? I think this token will expire again in 2 years and the VM will fail to start again without warning. Is there any way to make the connection inform me of approaching token expiration? I tried setting up an Alert but I do not see the right signal. The signals are just "log search" and "activity log", nothing about token expiration:
Sai Prabhu Naveen Parimi 1,255 Reputation points Microsoft External Staff

2025-04-23T11:31:20.39+00:00

@Sergey Borovoy

Thanks for the update, and glad to hear that you found the workaround via the Developer Tools → API connection section — great call on digging into that!

Regarding the automatic token refresh: yes, I’ve seen that article as well, and it does mention that Logic Apps are supposed to handle token refresh internally. However, this behavior can vary depending on the type of connection and authentication method used. For example, with service principal–based connections, the token can expire silently without triggering a refresh.

To avoid this kind of issue going forward, I’d recommend using a Managed Identity for the Logic App to connect to the VM, if possible. Managed Identity doesn’t rely on long-lived tokens or secrets and is automatically handled by Azure, which eliminates the risk of token expiration like this.
Sai Prabhu Naveen Parimi 1,255 Reputation points Microsoft External Staff

2025-04-24T08:05:59.44+00:00

@Sergey Borovoy

Just checking in to see if you had any questions or if there's anything else I can help with.
Sergey Borovoy 541 Reputation points

2025-04-24T20:55:21.2033333+00:00

Hello Sai Prabhu Naveen Parimi, and once again thank you for your generous explanations. I am happy to know that using MI-based connections in Logic Apps is an option, and I should definitely look into this.

Thanks again and have a nice upcoming weekend!

Sergey

PS I'm not sure how to mark my question "resolved" and whether this is possible or needed at all. Poked around the page, couldn't find any button to that effect.
Sergey Borovoy 541 Reputation points

2025-04-24T21:03:55.2966667+00:00
ᅟᅟᅟᅟᅟ
Sai Prabhu Naveen Parimi 1,255 Reputation points Microsoft External Staff

2025-04-25T03:23:56.9533333+00:00

Sergey Borovoy

Thank you for your kind words, and I’m glad to hear the information was helpful! It’s great that you’re considering using Managed Identity (MI) for future connections – that’s definitely a step in the right direction for seamless and long-term operation.

To close the loop, you can mark the question as resolved by clicking "Accept the answer". This will notify others that the issue has been resolved, and they can benefit from the solution too.

If you have any more questions down the line, feel free to reach out.
Sergey Borovoy 541 Reputation points

2025-04-29T09:36:51.7266667+00:00

Hi, well that's exactly the problem - I didn't see that "Accept answer" button anywhere, and I still don't. That's weird.
Sai Prabhu Naveen Parimi 1,255 Reputation points Microsoft External Staff

2025-04-29T12:13:15.46+00:00

Sergey Borovoy

Just to help guide you, please refer to this official Microsoft documentation on how to accept an answer: https://learn.microsoft.com/en-us/answers/support/accept-answer#accept-an-answer

Could you check the private message and respond, please

Here is the reference link on how to access & data retention policy of private messages in Microsoft Q&A.
Sergey Borovoy 541 Reputation points

2025-04-30T21:31:40.7466667+00:00

Okay, the "Accept answer" button is now there, I just clicked it. I am 100% certain it wasn't there before.
Many thanks once again and all the best.

Share via

Logic app fails to connect to Azure VM citing expired token, but the connection in Config is shown as OK

0 additional answers

Your answer