The provided grant has expired due to password change on Quest on Demand Tool (4377468)

Customers performing tenant-to-tenant migrations using Quest On Demand (Exchange, Teams, SharePoint, and OneDrive) may encounter errors related to token expiration. The error message typically states:
“The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on (authtime) and the TokensValidFrom date (before which tokens are not valid) for this user is (validate).”

This error occurs after a Global Administrator account, used for granting consents in Quest On Demand, has its password changed. Customers with policies requiring password resets after consent granting may experience repeated token expiration and consent revocation.

This issue arises due to security mechanisms built into Azure Active Directory. When a password change is detected for a Global Administrator account:

1. Consents and Tokens: Quest On Demand creates service principals and grants permissions in Azure AD when a Global Administrator provides consent. These permissions allow the migration tool to access tenant resources.
2. Security Measures in Azure AD: A password change is treated as a significant security event. As a protective measure, Azure AD revokes any existing consents and invalidates authentication tokens linked to the changed credentials. This prevents unauthorized access, ensuring only valid, up-to-date credentials are used for permissions.

To address the issue and ensure a smoother migration process, consider the following suggestions:

1. Temporary Exemption from Password Reset Policies:

   • If feasible and security policies allow, temporarily exempt the Global Administrator account used for Quest On Demand from mandatory password resets during the migration. This can prevent tokens from expiring and consents from being revoked.
   • Before implementing this exemption, consult with your organization’s security team to ensure that this approach aligns with your security standards and requirements.