Scheduled Pipelines fail due to "The refresh token has expired due to inactivity."

[keith_smith1]

We have several pipelines that were created 3 months ago that are now all suddenly failing with "The refresh token has expired due to inactivity" message. 

This appears to be a pipeline level failure, with every task component that is called returning this error:

AADSTS700082: The refresh token has expired due to inactivity.

This includes an Invoke task which calls an error reporting pipeline. I know the error reporting pipeline is still functioning because it works for other pipelines. Regardless of updates to the Datasource logins the error persists. (not related to expired login attached to task's connection)

The common answer I found is that the token for the pipeline has expired and opening it and re-saving will solve the problem. I can confirm that changing the descripting slightly and saving seemed to be enough to fix the problem.

Please tell me this is not working as intended.

Can someone please explain to me why this is happening and how to prevent it from happening again? Is it related to the owner's user id?

[oussamahaimoud · Accepted solution]

Hi @keith_smith1,

Hope you're doing well!

--> SITUATION : 

You've hit a real pain point in Microsoft Fabric, and yes, the resave workaround is a sign that something is not working as intended, or at least not as well as it should.

--> ROOT CAUSE :

When you create or save a pipeline in Fabric, it stores a refresh token tied to the identity of the person who last saved it (the pipeline owner). This token is what Fabric uses to authenticate all the activity inside that pipeline when it runs on a schedule. So, It's not just about the data source connections, it's about the pipeline's own execution context.

Microsoft Entra ID (formerly Azure AD) enforces a policy where refresh tokens expire after 90 days of inactivity. That's exactly why your pipelines broke all at once after approximatively 3 months because the token crossed that 90-day threshold and became invalid.

--> Why resaving fixes it ?

When you open and resave the pipeline (even just changing the description), Fabric reauthenticates as the current user and issues a brand new refresh token, resetting that 90-day clock. It's essentially a token refresh triggered by a manual action.

This is frustrating, but it's a known limitation in how Fabric currently manages pipeline credentials. It's not a bug per se, but it's definitely a gap in the product, there's no built in mechanism to auto renew these tokens in the background.

--> Is it tied to the owner's identity?

YES, because the refresh token is bound to the user who last saved the pipeline. This has a few important implications:

• If that person leaves the company or loses permissions, the pipeline will fail even before the 90 days are up
• If the token expires, only someone with edit access re-saving the pipeline can fix it
• This is why using a service principal or a shared service account as the pipeline owner is the recommended long-term approach, service principal tokens are managed differently and don't have the same inactivity expiration issue

--> REMEMBER THAT : You're right to push back on this. The resave workaround is a real workaround, not a feature. Microsoft is aware of this pattern and it's an active area of improvement in Fabric. For now, the most robust fix is to move pipeline ownership to a service principal, so you're no longer at the mercy of user-bound token expiration.

Check this --> Fabric Community Thread --> Same Error, Confirmed Behavior : https://community.fabric.microsoft.com/t5/Service/The-refresh-token-has-expired-due-to-inactivity-Th...

Hope this helps. Feel free to ask me questions if needed, and don’t forget to Accept as Solution if this guidance worked for you. That's motivate me to keep helping.

Best regards,

Oussama (Data Consultant & Fabric's Expert)