Logic App: Issue with OAuth Token Failure in Office 365 Outlook Connector

Question

Logic App: Issue with OAuth Token Failure in Office 365 Outlook Connector

MP-9390 0

Descrizione del problema

I am experiencing a problem with my Logic App (Standard) private that uses the Office 365 Outlook connector. The workflow, named Email_ingestion, fails during execution with the error 'WorkflowAppOAuthTokenFailure'. Although th api connection,, appears to be connected, the workflow cannot obtain a valid OAuth token to access the shared mailbox in the tenant where the mailbox is hosted.

Ambiente

Web App, Office 365 Outlook, Microsoft.Web/sites

Cosa ho già provato

I have examined the details of the case and the available diagnostic information. The connection appears to be established and in a connected state. I also verified that the API connection is reachable and the API connection resource shows no anomalies. I have not yet performed any configuration changes or token refresh attempts beyond initial setup.

Stato attuale

Currently, I am seeking assistance to confirm if the issue is related to tenant or consent misalignment, or if there are other configuration issues. I need guidance on how to verify the OAuth token acquisition process and how to troubleshoot the connection's authentication flow.

Tejaswini Billakurthi 760 Reputation points Microsoft External Staff Moderator

2026-10-01T11:36:14.4833333+00:00

Hello @MP-9390 ,

Thank you for reaching out to Microsoft Q & A !

The WorkflowAppOAuthTokenFailure error indicates an OAuth authentication failure during workflow execution, but the API connection showing as Connected does not by itself identify the underlying cause.

I would recommend checking the following in this order:

Check the exact failed run

Open:

Logic App → Email_ingestion → Run history → failed run → failed trigger/action

Review the Inputs, Outputs, and error details for the failed step. If the failure occurs on the trigger, also check the trigger history and its inputs/outputs.

This should provide the detailed runtime error needed to further isolate the authentication or connector failure.

Verify the connection account and Outlook operation

Confirm which Microsoft 365 account authorized the Office 365 Outlook connection, which Outlook trigger/action is failing, and whether that account has the required access to the target shared mailbox.

This is important because the API connection being shown as Connected does not necessarily explain why the workflow is failing at runtime.

Reauthenticate the existing connection

Reauthenticate the Office 365 Outlook connection and run the workflow again.

If reauthentication does not resolve the issue, you can also test with a newly created Office 365 Outlook connection authorized by the intended Microsoft 365 account. This can help determine whether the issue is specific to the existing connection.

Check Microsoft Entra authentication if the runtime evidence points there

If the failed run or Microsoft Entra sign-in logs show an authentication or Conditional Access error (for example, an AADSTS error), investigate the corresponding account, consent, or Conditional Access configuration.

At this stage, I would not assume that the issue is caused by cross-tenant configuration, managed identity, or a stale $connections reference without seeing the actual runtime error.

If the Logic App was deployed through ARM/Bicep/Terraform/CI-CD, or if the API connection was recently replaced, then validating the workflow's connection reference would also be appropriate.

The most useful information to provide next would be the exact error details from the failed trigger/action, with tokens, email addresses, and other sensitive information redacted. That should help further isolate whether the failure is related to authentication, mailbox access, Conditional Access, or the connector/runtime.

Please "Upvote the Answer" if this information helped you. This will help us and others in the community as well.

2 answers

Your answer

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 2

Hi @MP-9390

A Connected API connection does not, by itself, confirm that the workflow runtime can obtain and use the required token. In a Standard Logic App, a managed connector involves two authentication paths: one between the workflow and the managed API connection, and another between that connection and Office 365.

Verify the following:

Open the failed trigger in Run history and review its raw outputs. Capture the complete inner error, HTTP status, and any AADSTS code. WorkflowAppOAuthTokenFailure alone is insufficient to identify whether the failure is caused by the Logic App connection, Microsoft Entra Conditional Access, or Exchange mailbox authorization.
In the Standard Logic App, open Workflows > Connections > API Connections and confirm that the workflow references the intended Office 365 connection. Standard workflows store the connection mapping in connections.json.
If the Logic App or API connection was deployed through ARM/Bicep or another pipeline, verify that the managed API connection has an access policy for the Logic App’s managed identity. Every managed API connection used by a Standard workflow requires an associated access policy.
Confirm that the account used to create the Office 365 Outlook connection belongs to the tenant hosting the mailbox and has access to that shared mailbox. Use an Outlook connector operation that explicitly supports shared mailboxes and enter the shared address in its Mailbox address parameter. Mailbox-permission changes can take approximately two hours to propagate.
If the connector’s inner error is AADSTS53003, review the user’s Microsoft Entra sign-in logs and Conditional Access result. Conditional Access can block token issuance for this connector.

If the connection mapping, access policy, and mailbox permissions are correct, reauthorize or recreate the Office 365 connection using the intended mailbox-enabled account and then reselect that connection in the workflow. Deleting and recreating the Outlook connection is among its shared-mailbox troubleshooting actions.

Please provide the complete inner error from the failed trigger and indicate whether the Logic App/API connection was created in the portal or deployed through automation; that will distinguish a runtime access-policy failure from an Office 365 token or mailbox-permission failure.

References:

Authenticate Access for Connections

View Workflow Status

Edit and Manage Workflows

API connection resources and access policies

Shared Mailbox Support

Office 365 Outlook Common Errors

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.