Saved ADMIN profile doesn't work the next day

[sanjeev40084]

I created a new admin authentication profile for GCC instance. The admin feature worked after the authentication profile was saved. The next day when i tried to use the same 'ADMIN' profile, i ended up getting the following error message:

*Error: AADSTS70043: The refresh token has expired or is invalid due to sign-in frequency checks by conditional access. The token was issued on 2022-02-01T19:57:21.3802393Z and the maximum allowed lifetime for this request is 86400. *

Since my account uses MFA, i believe whatever token it had saved at the time of creation probably is expired and needs a new token to authenticate. Currently i don't see any option within 'pac admin' module to do that.

Am i supposed to delete my saved ADMIN profile and recreate new ADMIN profile to get the admin feature working again?

[orangetoken]

You can just do "pac auth clear" and then recreate the profile.

I have this script saved:

$profileName = 'MyProfile'
pac auth clear
pac auth create -k ADMIN -u https://service.powerapps.com/ -n $profileName

[sanjeev40084]

@orangetoken is that how it is supposed to be used though. i.e. are we supposed to clear the previously saved profile, before using it again.

[tehcrashxor]

By default, AAD Refresh Tokens expire after 90 days, but that value can be reduced based on your AAD Tenant's policies.
Since the error message indicated a maximum lifetime of 86400 seconds (24 hours), it is likely that your Tenant Admins have set the MaxInactiveTime or MaxAgeMultifactor policies listed in the "Refresh and session token lifetime policy properties" section of the documentation here.

As for creating the new profile, you can either remove the old ones with pac auth clear to purge all existing profiles, pac auth delete by index or name to remove the single one, or just pac auth create with the same values as you used before, as that will overwrite the existing profile with the same parameters.

We have a work item tracking making better error messages for this, tracked as bug 2448310 in our internal DB.

[sanjeev40084]

Got it. Thanks for the info @tehcrashxor