← Al Davies, 250 High Street

Flow fails because the connection expired: how to fix it

Short answer: a Power Automate connection expired when its saved sign-in stops working, and the flow fails with a 401 or "Unauthorized" error. Open the failed run, choose Fix connection, sign in again, then choose Resubmit. Add a failure alert so the next break does not sit unseen for days.

What a connection is, and why it breaks

Think of a connection as a stored login that lets the flow talk to one app on your behalf. Microsoft says: "Power Automate uses connections to make it easy for you to access your data while building flows."

Here are the causes Microsoft names on its connection failures page:

Microsoft's page on refresh tokens gives a general number too: "90 days for all other scenarios." It also says tokens "can be revoked by the sign-in service at any time before their expiration." That means a connection can fail well before day 90. Your tenant settings decide the real timing, so ask your admin.

Cause and fix at a glance

Signs a connection expired

Microsoft says: "In many cases, flows fail because of an authentication error. If you have this type of error, the error message contains Unauthorized or an error code of 401 or 403 appears."

Step 1. Find the failed run

  1. Go to https://make.powerautomate.com and log in.
  2. Under My flows, click the flow that stopped working.
  3. Scroll the 28-day run history to the run marked Failed and click its date.
  4. Click the step flagged with a red exclamation icon. The error text is inside it.

Labels can differ a little between versions. A flow that seems missing may sit in another environment, so check the environment picker at the top right. The Microsoft help pages in the sources show the current screens.

Step 2. Read the error code

Microsoft's error table reads like this:

A 401 points at the connection, and a 403 can too. A 404 is different: the flow's target list, file or mailbox changed, so open the action and point it at the right place. If the flow was switched off instead of failing, see "Why Power Automate turned your flow off, and how to turn it back on".

Step 3. Fix the connection

Microsoft's steps for an authentication failure:

  1. On the right pane below How to fix, select View Connections.
  2. Scroll to the connection for which you saw the Unauthorized error message.
  3. Next to the connection, select the Fix connection link.
  4. Verify your credentials by following the instructions that appear.
  5. Return to your flow-run failure, and then select Resubmit.

Microsoft then says: "The flow should now run as expected."

You can also fix a connection from the Connections page. Microsoft says you can update a connection that is not working "because your account details or your password changed." Open https://make.powerautomate.com, go to Connections, and use the Fix connection link. Microsoft adds that updating a connection updates it in both Power Apps and Power Automate.

If the connection belongs to someone else, Microsoft says: "If the flow uses a shared connection (owned by someone else), you need that person to re-authenticate, or you can create your own connection and update the flow to use it."

Step 4. Resubmit and check

Resubmit runs the failed run again. Microsoft shows Resubmit as the last step after a fix. After it finishes, open the run and confirm every step shows a green check. Then watch the next scheduled or triggered run, not just the resubmitted one.

Resubmit does not catch up on runs that never started. For polling triggers such as recurrence, Microsoft's trigger troubleshooting page says that when you turn a flow back on, "it processes all unprocessed or pending events." Other triggers may not. If the flow failed or was off for days, check the source list or mailbox for items that were missed, and process them by hand.

Step 5. Find the other flows that use the same connection

One bad connection can break several flows. Microsoft says you can find them: on the Connections page, select the connection, choose the three dots, then Details. From there, "Flows using this connection" lists them. Fix once, then open each listed flow and check its latest run.

Step 6. Stop it from happening in silence

Microsoft's advice is to build in a failure notification: "For critical production flows, send failure notifications to a shared mailbox or Teams channel so the alert isn't missed." In the flow, add a parallel branch under the riskiest action. Open its Configure run after settings and tick only "has failed". Then place a Send an email or Teams post action in that branch and put the error details in the message.

Microsoft also says repair tips are "sent to flow owners via email whenever a cloud flow fails." The email lands with the owner alone, so an absent or departed owner means no one is told. Our advice, not a Microsoft rule: point alerts at a shared inbox or channel that at least two people watch.

Microsoft also suggests: "For production flows, check the run history page once a week." A recurring calendar reminder assigned to one named person is a simple way to keep that habit. To keep a list of every flow, who owns it and who backs them up, see "The person who built your flows left: what happens and what to do".

Choosing who owns the connection

A flow tied to one person's own login breaks whenever that login changes. Microsoft's page on connection failures says: "Service principal connections don't rely on a user's OAuth token. They don't expire when someone changes their password or leaves the organization." It advises: "ask your admin about setting up service principal connections for your key connectors."

A second trigger from Microsoft: if a Conditional Access policy includes a Terms of Use grant control, "existing flow connections can break retroactively because the silent token refresh can't present the Terms of Use acceptance page." Microsoft's advice there is to exclude "service accounts and dedicated flow connection owners" from that policy. That is an admin task.

On Microsoft Q&A, one reply about repeated re-sign-in reads: "We solved this issue recently by placing the service accounts in an MFA exclusion group." That is a single user's report, not a Microsoft rule. Your security team decides whether it suits your company.

Our advice, not a Microsoft rule: never pass around one person's personal login just to keep a connection alive. Ask your admin which approved work account a flow may use, and confirm what your license allows. Licenses are outside this guide.

When the connection owner leaves the company

A connection tied to a person's own login is a risk when that person leaves, because nobody can sign it in again. Microsoft says: "If the flow uses a shared connection (owned by someone else), you need that person to re-authenticate, or you can create your own connection and update the flow to use it." If the owner is gone, create a new connection under a person who stays and point the flow's actions at it. For a lasting fix, Microsoft says service principal connections "don't expire when someone changes their password or leaves the organization," so ask your admin about them. For the full owner-left steps, see "The person who built your flows left: what happens and what to do".

What to avoid

Honest limits

Some people on Microsoft Q&A report that connections break at times they cannot predict, and Microsoft's reply there does not say when. This guide covers cloud flows. Your tenant may have different policies, and menu names change. Confirm the details on the Microsoft pages linked below.

When to get help

You can build all of this yourself in Microsoft 365. If you would rather have it built and tested for your team, I do that. A tracker like this is a fixed price: $5,000 for one, built in 2 weeks. See "What a SharePoint tracker costs to build". Bring one example of the problem to a free call.

Tell me what's still manual

I am Al Davies. I run 250 High Street LLC and build SharePoint trackers and Power Automate flows for operations teams. I work remotely. The first call is free, and I will not try to sell you anything.

See trackers I built: Tools I built

FAQ

Power Automate connection token expired: how do I know that is the cause?

Open the failed run. Microsoft says authentication errors show "Unauthorized" or an error code of 401 or 403, while 404 means the target was renamed, moved or deleted.

Power Automate connection expiry: how long does a connection last?

Microsoft says "OAuth refresh tokens expire after approximately 90 days of inactivity," and its refresh token page says tokens can also be revoked sooner, so 90 days is one cause, not the only one.

Does changing my password break my flows?

Yes, for connections that use your sign-in. Microsoft says the stored OAuth token "is now invalid" after a password change, and Fix connection repairs it.

What happens to my flows when the connection owner leaves the company?

Microsoft says a shared connection needs its owner to re-authenticate, or you create your own connection and update the flow, while service principal connections do not expire when someone leaves.

Can I stop connections from ever expiring?

Microsoft's pages do not describe a setting that does that for user sign-ins. It describes service principal connections that do not depend on one person's password. Ask your admin if that fits your tenant.

Sources