# Flow fails because the connection expired: how to fix it

> For the full documentation index, see https://250highstreet.com/llms.txt

> A Power Automate flow stopped with a 401 error? The connection expired. Use Fix connection, resubmit the run, and set up alerts so you hear about it first.

Short answer: a Power Automate connection expired when its saved sign-in stops working, and the flow fails with a 401 or "Unauthorized" error. Open the failed run, choose Fix connection, sign in again, then choose Resubmit. Add a failure alert so the next break does not sit unseen for days.

## What a connection is, and why it breaks

Think of a connection as a stored login that lets the flow talk to one app on your behalf. Microsoft says: "Power Automate uses connections to make it easy for you to access your data while building flows."

Here are the causes Microsoft names on its connection failures page:

- A new password: "You changed your password, or your organization enforces periodic password rotation. The stored OAuth token is now invalid."
- A tighter sign-in rule: Microsoft says an admin turning on or changing multifactor authentication can mean "The existing token no longer satisfies the new policy."
- Withdrawn consent: "An admin revoked the app consent that Power Automate uses to access a service on your behalf."
- Long idle stretch: "OAuth refresh tokens expire after approximately 90 days of inactivity. If a flow hasn't run in 90 days, the connection might need re-authentication."
- Expired app secret: for a connection built on a service principal, "the client secret might be expired."

Microsoft's page on refresh tokens gives a general number too: "90 days for all other scenarios." It also says tokens "can be revoked by the sign-in service at any time before their expiration." That means a connection can fail well before day 90. Your tenant settings decide the real timing, so ask your admin.

## Cause and fix at a glance

- Password change or password rotation: sign in again with Fix connection.
- MFA or sign-in policy change: sign in again with Fix connection, then ask your admin what changed.
- Admin consent revoked: your admin must restore the consent.
- About 90 days with no run: sign in again with Fix connection.
- Expired secret on a service principal connection: your admin generates a new secret in Microsoft Entra ID and updates the connection.

## Signs a connection expired

- The latest run shows Failed, and the red step says Unauthorized, 401 or 403.
- A flow that ran every night stopped on one date.
- A flow works for some people and not for others.
- Several flows owned by one person broke on the same day.
- A flow is marked Suspended on its details page.

Microsoft says: "In many cases, flows fail because of an authentication error. If you have this type of error, the error message contains Unauthorized or an error code of 401 or 403 appears."

## Step 1. Find the failed run

1.  Go to [https://make.powerautomate.com](https://make.powerautomate.com) and log in.
2.  Under My flows, click the flow that stopped working.
3.  Scroll the 28-day run history to the run marked Failed and click its date.
4.  Click the step flagged with a red exclamation icon. The error text is inside it.

Labels can differ a little between versions. A flow that seems missing may sit in another environment, so check the environment picker at the top right. The Microsoft help pages in the sources show the current screens.

## Step 2. Read the error code

Microsoft's error table reads like this:

- 401 Unauthorized: "Your connection token expired, or your password changed."
- 403 Forbidden: "You don't have permission to access the resource, or a DLP policy is blocking the connector."
- 404 Not Found: "The resource was deleted, renamed, or moved."

A 401 points at the connection, and a 403 can too. A 404 is different: the flow's target list, file or mailbox changed, so open the action and point it at the right place. If the flow was switched off instead of failing, see "[Why Power Automate turned your flow off, and how to turn it back on](/guides/power-automate-flow-turned-off-automatically/)".

## Step 3. Fix the connection

Microsoft's steps for an authentication failure:

1.  On the right pane below How to fix, select View Connections.
2.  Scroll to the connection for which you saw the Unauthorized error message.
3.  Next to the connection, select the Fix connection link.
4.  Verify your credentials by following the instructions that appear.
5.  Return to your flow-run failure, and then select Resubmit.

Microsoft then says: "The flow should now run as expected."

You can also fix a connection from the Connections page. Microsoft says you can update a connection that is not working "because your account details or your password changed." Open [https://make.powerautomate.com](https://make.powerautomate.com), go to Connections, and use the Fix connection link. Microsoft adds that updating a connection updates it in both Power Apps and Power Automate.

If the connection belongs to someone else, Microsoft says: "If the flow uses a shared connection (owned by someone else), you need that person to re-authenticate, or you can create your own connection and update the flow to use it."

## Step 4. Resubmit and check

Resubmit runs the failed run again. Microsoft shows Resubmit as the last step after a fix. After it finishes, open the run and confirm every step shows a green check. Then watch the next scheduled or triggered run, not just the resubmitted one.

Resubmit does not catch up on runs that never started. For polling triggers such as recurrence, Microsoft's trigger troubleshooting page says that when you turn a flow back on, "it processes all unprocessed or pending events." Other triggers may not. If the flow failed or was off for days, check the source list or mailbox for items that were missed, and process them by hand.

## Step 5. Find the other flows that use the same connection

One bad connection can break several flows. Microsoft says you can find them: on the Connections page, select the connection, choose the three dots, then Details. From there, "Flows using this connection" lists them. Fix once, then open each listed flow and check its latest run.

## Step 6. Stop it from happening in silence

Microsoft's advice is to build in a failure notification: "For critical production flows, send failure notifications to a shared mailbox or Teams channel so the alert isn't missed." In the flow, add a parallel branch under the riskiest action. Open its Configure run after settings and tick only "has failed". Then place a Send an email or Teams post action in that branch and put the error details in the message.

Microsoft also says repair tips are "sent to flow owners via email whenever a cloud flow fails." The email lands with the owner alone, so an absent or departed owner means no one is told. Our advice, not a Microsoft rule: point alerts at a shared inbox or channel that at least two people watch.

Microsoft also suggests: "For production flows, check the run history page once a week." A recurring calendar reminder assigned to one named person is a simple way to keep that habit. To keep a list of every flow, who owns it and who backs them up, see "[The person who built your flows left: what happens and what to do](/guides/power-automate-flow-owner-left-company/)".

## Choosing who owns the connection

A flow tied to one person's own login breaks whenever that login changes. Microsoft's page on connection failures says: "Service principal connections don't rely on a user's OAuth token. They don't expire when someone changes their password or leaves the organization." It advises: "ask your admin about setting up service principal connections for your key connectors."

A second trigger from Microsoft: if a Conditional Access policy includes a Terms of Use grant control, "existing flow connections can break retroactively because the silent token refresh can't present the Terms of Use acceptance page." Microsoft's advice there is to exclude "service accounts and dedicated flow connection owners" from that policy. That is an admin task.

On Microsoft Q&A, one reply about repeated re-sign-in reads: "We solved this issue recently by placing the service accounts in an MFA exclusion group." That is a single user's report, not a Microsoft rule. Your security team decides whether it suits your company.

Our advice, not a Microsoft rule: never pass around one person's personal login just to keep a connection alive. Ask your admin which approved work account a flow may use, and confirm what your license allows. Licenses are outside this guide.

## When the connection owner leaves the company

A connection tied to a person's own login is a risk when that person leaves, because nobody can sign it in again. Microsoft says: "If the flow uses a shared connection (owned by someone else), you need that person to re-authenticate, or you can create your own connection and update the flow to use it." If the owner is gone, create a new connection under a person who stays and point the flow's actions at it. For a lasting fix, Microsoft says service principal connections "don't expire when someone changes their password or leaves the organization," so ask your admin about them. For the full owner-left steps, see "[The person who built your flows left: what happens and what to do](/guides/power-automate-flow-owner-left-company/)".

## What to avoid

- Resubmitting first: the run fails again until the connection is repaired.
- Repairing one flow only: its siblings on the same connection are still broken.
- Trusting the owner's inbox as the only alarm: route alerts to a shared spot.
- Skipping the weekly run history look on flows the business needs.
- Handing a shared personal password to the team.
- Editing security settings on your own: that belongs to your admin.

## Honest limits

Some people on Microsoft Q&A report that connections break at times they cannot predict, and Microsoft's reply there does not say when. This guide covers cloud flows. Your tenant may have different policies, and menu names change. Confirm the details on the Microsoft pages linked below.

## When to get help

You can build all of this yourself in Microsoft 365. If you would rather have it built and tested for your team, I do that. A tracker like this is a fixed price: \$5,000 for one, built in 2 weeks. See "[What a SharePoint tracker costs to build](/guides/what-a-sharepoint-tracker-costs/)". Bring one example of the problem to a free call.

I am Al Davies. I run 250 High Street LLC and build SharePoint trackers and Power Automate flows for operations teams. I work remotely. The first call is free, and I will not try to sell you anything.

See trackers I built: [Tools I built](/portfolio/)

## FAQ

### Power Automate connection token expired: how do I know that is the cause?

Open the failed run. Microsoft says authentication errors show "Unauthorized" or an error code of 401 or 403, while 404 means the target was renamed, moved or deleted.

### Power Automate connection expiry: how long does a connection last?

Microsoft says "OAuth refresh tokens expire after approximately 90 days of inactivity," and its refresh token page says tokens can also be revoked sooner, so 90 days is one cause, not the only one.

### Does changing my password break my flows?

Yes, for connections that use your sign-in. Microsoft says the stored OAuth token "is now invalid" after a password change, and Fix connection repairs it.

### What happens to my flows when the connection owner leaves the company?

Microsoft says a shared connection needs its owner to re-authenticate, or you create your own connection and update the flow, while service principal connections do not expire when someone leaves.

### Can I stop connections from ever expiring?

Microsoft's pages do not describe a setting that does that for user sign-ins. It describes service principal connections that do not depend on one person's password. Ask your admin if that fits your tenant.

## Sources

- [Fix connection failures in cloud flows (error codes, why connections break, Fix connection, failure notification, service principal)](https://learn.microsoft.com/en-us/power-automate/fix-connection-failures)
- [Troubleshoot a cloud flow (authentication failures, Resubmit, repair tips, Conditional Access)](https://learn.microsoft.com/en-us/power-automate/fix-flow-failures)
- [Manage connections in Power Automate (Update a connection, flows using a connection)](https://learn.microsoft.com/en-us/power-automate/add-manage-connections)
- [Refresh tokens in the Microsoft identity platform (90 day default, revocation)](https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens)
- [Microsoft Q&A, Power Automate authentication issues and reauthenticating connections](https://learn.microsoft.com/en-us/answers/questions/1792707/power-automate-authentication-issues-i-need-to-rea)
- [Microsoft Learn, Troubleshoot common problems with Power Automate triggers](https://learn.microsoft.com/en-us/troubleshoot/power-platform/power-automate/flow-run-issues/triggers-troubleshoot)

## Related guides

- [Fix 401 Unauthorized in Power Automate](/guides/power-automate-401-unauthorized/)
- [Power Automate 403 Forbidden on a SharePoint action: what to check](/guides/power-automate-403-forbidden-sharepoint-connection/)
- [My Power Automate flow run timed out: what it means and how to fix it](/guides/power-automate-flow-run-timed-out/)

Source: https://250highstreet.com/guides/power-automate-connection-expired-flow-failing/