Connection expired after password change

After a password change, a Power Automate flow often keeps running as usual until it suddenly stops with a red error message. The reason is almost always the same: the affected connection was created with the old password, and its stored OAuth token is rejected as invalid on the next run attempt. This affects not only you, but anyone using a flow with a shared connection that points to your account.

The good news: in most cases, the error can be fixed within minutes without rebuilding the flow. This article shows you how to recognize the problem, how to find and repair the affected connection, and how to better protect yourself before the next password change. As of: July 2026.

Why the connection expires after a password change

Every connection in Power Automate stores an OAuth refresh token in the background, which the flow uses to re-authenticate on every run. If you change your password, Microsoft Entra ID retroactively invalidates all tokens that were valid at that time, according to the official documentation on Troubleshooting broken connections. The specific error message reads roughly: "The granted permission token has expired due to revocation, so a new authentication token is needed. The user may have changed or reset their password." This message appears regardless of whether you changed the password yourself or it was reset because it had expired.

Important to know: this is not a bug or an exception, but expected behavior. Every password change automatically invalidates every existing connection that was created with the old password, individually for each connector.

How to identify the affected connection

An expired token usually shows up in the flow as HTTP error 401 (Unauthorized) or as the error code ConnectionAuthorizationFailed. According to the Error code reference for cloud flows, this code means: the connection itself still exists, but its stored credentials are no longer valid, for example because the password was changed or an MFA method was reset.

• Open the failed run in your flow's run history and find the action marked in red.
• Expand the action and check whether the error message contains 401, "Unauthorized" or "ConnectionAuthorizationFailed".
• Alternatively, go directly to Power Automate > Connections and look for a warning or error icon next to the affected connection.

Fixing the connection step by step

The fix works the same way for most connectors, whether it's SharePoint, Outlook, Teams, or another standard connector:

• Open Power Automate and switch to Connections in the left-hand navigation.
• Find the connection with the error icon.
• Select the three dots (...) next to the connection, then Fix connection or Edit.
• Sign in again with your new password, including multi-factor authentication if required.
• Go back to your flow and check whether the affected action now shows a green checkmark.

These steps are also described in the official guide Fix connection failures in cloud flows in the section on connection health checks. If the flow uses a shared connection owned by someone else, you can't fix it yourself: either that person needs to re-authenticate the connection, or you create your own connection and assign it to the action in the flow.

When fixing it alone isn't enough

Sometimes the error persists even with a new password. There are several documented reasons for this, which you can rule out one by one:

• MFA policy changed: An administrator has enabled or adjusted multi-factor authentication, so the old token no longer meets the new policy.
• Consent revoked: An administrator has revoked the app consent for Power Automate in Microsoft Entra ID.
• 90 days of inactivity: OAuth refresh tokens expire independently of the password after about 90 days without use, which can trigger the same error if a flow hasn't run for a long time.
• Service principal secret expired: For connections via a service principal, a new client secret must instead be generated in Microsoft Entra ID and stored in the connection.

These causes are listed in detail in the documentation on connection health checks in Fix connection failures in cloud flows. If the error persists after fixing it, it's also worth checking the Microsoft Entra sign-in logs to rule out blocks caused by conditional access policies.

How to avoid this problem permanently

For individual, personally used flows, the problem can't be fully avoided, since every connection depends on the password of the respective account. For production flows that run as a team or unattended, the documentation therefore recommends switching to service principal connections where possible: these don't expire when a person changes their password or leaves the company. In addition, a fixed calendar reminder helps to renew the stored credentials for service accounts in time before they expire automatically. Anyone who wants to run their Power Automate flows in production with clean error handling can get support from NordFlux's Power Automate services.

Frequently asked questions

Why does my flow stop working after a password change even though I haven't changed anything in the flow?

Because the connection's stored OAuth token was tied to your old password. Microsoft Entra ID automatically invalidates all previously issued tokens for that account with every password change, regardless of whether you modified the flow yourself.

Do I have to rebuild the flow if the connection has expired?

No. In most cases, it's enough to re-authenticate the affected connection under Power Automate > Connections via Fix connection. The flow itself remains unchanged.

What exactly does the error code ConnectionAuthorizationFailed mean?

It means the connection itself still exists, but its stored credentials are no longer valid, for example due to a password change, a reset MFA method, or revoked app access.

What do I do if I can't fix the affected connection myself?

This happens with shared connections owned by someone else. In this case, either that person needs to re-authenticate the connection, or you create your own connection and assign it to the affected action in the flow.

How do I prevent production flows from failing with every password change?

The most reliable way is to use service principal connections, since they don't rely on the OAuth token of an individual user account and therefore don't automatically expire when someone changes their password.