AADSTS50173 — "The provided grant has expired due to it being revoked, a fresh auth token is needed." The refresh token or session artefact the client presented is no longer valid because something invalidated it server-side: commonly a password change, an admin revoking sessions, or security-driven token revocation. Re-authentication is the designed outcome, not a fault.
AADSTS50173
Fresh token needed — grant expired or revoked
What it means
Common causes
The user changed their password (or it was reset), which revokes existing refresh tokens.
An admin revoked sessions (user > Revoke sessions in the portal, or
Revoke-MgUserSignInSession), often as part of incident response.Identity protection or policy-driven revocation events invalidated outstanding tokens.
Long-dormant clients returning with tokens that were revoked in the meantime.
How to fix it
Have the user sign in again interactively — that is the intended resolution.
If a device keeps looping on this error, clear its cached accounts/tokens (Windows: Settings > Accounts > Access work or school; browsers: sign out of the account) and sign in fresh.
If it recurs across many users without admin action, review recent password-reset activity and any automation calling session-revocation APIs.